This won't be as easy, but I just never thought about it: what about creating a Face ID for sudo on Mac?
Use Touch ID for Sudo on Mac
21–30 of 221 posts
Re: Use Touch ID for Sudo on Mac
#22Interesting, I hacked a small pam module together 4 years ago for the first generation of touch id enabled macbooks[0] and I wonder if pam_tid.so was always present and I just missed it. D'oh!
Re: Use Touch ID for Sudo on Mac
#23What happens when your Mac has multiple user accounts, some are admins and some are not, but all have Touch ID set up? Would that inadvertently give sudo power to users who shouldn't have it?
(I don't have a Touch ID Mac to find out.)
Re: Use Touch ID for Sudo on Mac
#24What happens when your Mac has multiple user accounts, some are admins and some are not, but all have Touch ID set up? Would that inadvertently give sudo power to users who shouldn't have it? (I don't have a Touch ID Mac to find out.)
No, it's bound to the user requesting sudo access.
Re: Use Touch ID for Sudo on Mac
#25Next step: SSH automatically paste password from Keychain/OnePass/LastPass after Touch ID.
Re: Use Touch ID for Sudo on Mac
#26As a side note, there's also the wonderful pam_yubiko module that allows you to require touching your yubikey to sudo or login.
Re: Use Touch ID for Sudo on Mac
#27As the author says, “Since you expect to be be typing in a command line, moving your finger to touch the key is probably not very efficient.” I was excited to set this up when the first fingerprint sensor macs came out. Within a couple of days I’d switched it off. It is quite inconvenient and especially bad if you use an external keyboard.
It still strikes me as weird that Apple went with Touch ID vs Face ID on the Mac. Computer form factors in general, and particularly notebooks and AIOs, should be perfect for Face ID: the user is always at a good distance, in the right position, looking at it, and as you say will frequently have their hands otherwise occupied actually controlling the system. For that matter a Face ID+iPhone-quality camera thing for Macs that could attach to an external monitor would be a pretty useful value-add, and it would equalize things across all Macs meaning it could be depended on more. It's remained really perplexing that year after year when Apple left Touch ID far behind on iOS they haven't installed Face ID where it'd be even better. I assume this is mainly another one of many symptoms of Apple just not being able to multitask very well and the Mac not really getting that much concerted attention.
Re: Use Touch ID for Sudo on Mac
#28Very handy. But you can use your Apple Watch for sudo which is even better: [0] [0] https://github.com/insidegui/pam-watchid
I agree using your watch is cool. However I think you lose out on the security aspect, an important element that a fingerprint provides all on the same device.
The watch is already used on other parts of the MacOS (anything in System Preferences), I don't think that sudo is much different than allowing kernel extension to run, for example.
Re: Use Touch ID for Sudo on Mac
#29Very handy. But you can use your Apple Watch for sudo which is even better: [0] [0] https://github.com/insidegui/pam-watchid
You have to take your fingers off the keyboard for this which is a big distractor, worse than using a mouse. I use this feature for other touch cases (e.g. unlocking 1Password) but would hate it when in the flow. Admittedly my password is well wired into my fingers.
I want a mouse with Touch ID in the button. Or on the side.
Re: Use Touch ID for Sudo on Mac
#30The article will not allow sudo changes on Big Sur - at least, not without changing permissions of the sudo file first: 1. sudo -Si 2. chmod 644 /etc/pam.d/sudo 3. vi /etc/pam.d/sudo 4. Add the 'Auth sufficient pam_tid.so' line 5. chmod 444 /etc/pam.d/sudo 6. ... 7. Profit! Very handy tip though, thanks!
I don’t get it, the article shows it in 2 steps why the 5 step verbosity??
[deleted]