Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Use Touch ID for Sudo on Mac

davidwalsh.name

Post reply on HN
Print view View original

131–140 of 221 posts

Re: Use Touch ID for Sudo on Mac

#131

Post by jeffbee »

lispm wrote: post #129
jeffbee wrote: post #122

Earlier quoted context omitted.

The thing that doesn't make sense here is that macOS discards randomly your settings, but it is also the only OS I use that regularly gets in a fucked up state where settings have to be nuked. I mean, here we are in year 37 of the mac and people are still zapping their PRAMs. The only improvement is you don't have to physically pull out the battery.

In year 37 you can't manually zap the 'PRAM' on Apple Silicon Macs.

True, but I guess 95% of mac users are still on Intel macs, are still being told by "genius" bar frontline support to reset the SMC / zap PRAM for any kind of issue, and this usually works, too. Jury is still out on whether the M1 auto-zapping architecture is better, or will just be more prone to being permanently messed up.

Re: Use Touch ID for Sudo on Mac

#133

Post by philsnow »

bitlevel wrote: post #8

The article will not allow sudo changes on Big Sur - at least, not without changing permissions of the sudo file first: 1. sudo -Si 2. chmod 644 /etc/pam.d/sudo 3. vi /etc/pam.d/sudo 4. Add the 'Auth sufficient pam_tid.so' line 5. chmod 444 /etc/pam.d/sudo 6. ... 7. Profit! Very handy tip though, thanks!

s/vi/visudo/

visudo will lint the resulting file and (should) reject the change if it would break your system.

Re: Use Touch ID for Sudo on Mac

#134

Post by m463 »

cprecioso wrote: post #56

This is amazing -- but every. single. update. disables it again Why does the sudo file not persist between updates? This case is quite minor for personal computers, but what about companies that log in with yubikeys or smart cards? Do they have to reconfigure after every update too?

Apple needs a solution to this.

People getting their pf rules thrown away each time - it is like unlocking your front door each time you run the vacuum cleaner.

Re: Use Touch ID for Sudo on Mac

#135

Post by samstave »

Demigod33 wrote: post #115
samstave wrote: post #111

Earlier quoted context omitted.

Why cant Apple use their TimeMachine tech to take a snapshot of the prefs on the existing, then do their image based update, then have it automatically apply the prefs from the timemachine mod-integration? The richest company in the world can't think different?

What if one file was written by a malicious program?

You know =what would be cool: If all apps had to register their pref config files into a single dir and that would be tracked and snapshotted - and then you could just have ALL apps look to the same dir for where their configs come from and you could have a single repo for ALL apps on your or ANY system - and then you could walk up to a terminal and plug in your "license key" which said what apps you had access to and what ones you had configs for and you could just run that app with all your input and prefs and mappings etc...

I actually wrote a white paper on just this in ~2003 or so - and met with several engineers from google and they said it was impossible.

The idea being that you only carried around with you your profile, and you could just come to a dumb terminal, plug in your key, three factor auth - and the terminal would give you access to the apps and resources they had...

(I should write ((again)) a short story on this)

Re: Use Touch ID for Sudo on Mac

#136

Post by ArchOversight »

philsnow wrote: post #133
bitlevel wrote: post #8

The article will not allow sudo changes on Big Sur - at least, not without changing permissions of the sudo file first: 1. sudo -Si 2. chmod 644 /etc/pam.d/sudo 3. vi /etc/pam.d/sudo 4. Add the 'Auth sufficient pam_tid.so' line 5. chmod 444 /etc/pam.d/sudo 6. ... 7. Profit! Very handy tip though, thanks!

s/vi/visudo/ visudo will lint the resulting file and (should) reject the change if it would break your system.

This isn't modifying the sudoers file, it is modifying the pam file.

Re: Use Touch ID for Sudo on Mac

#137

Post by beyondcompute »

jmarcher wrote: post #118
beyondcompute wrote: post #63

Earlier quoted context omitted.

I’ve just added this to my .bash_profile: enable-sudo-touchid() { sudo sed -i -e '1s;^;auth sufficient pam_tid.so\n;' /etc/pam.d/sudo } But probably automating the check (if the automated checker has the correct permission) would not be that hard.

A step further so you don't have to think about enabling it: sudo() { unset -f sudo if [[ "$(uname)" == 'Darwin' ]] && ! grep 'pam_tid.so' /etc/pam.d/sudo --silent; then sudo sed -i -e '1s;^;auth sufficient pam_tid.so\n;' /etc/pam.d/sudo fi sudo "$@" }

Thanks! That looks good!

Thought on the second thought, I’ll continue to use the more “manual” method for now. As it gives me more control and it would be easier to switch off when touch ID sudo will be supported more officially.

Re: Use Touch ID for Sudo on Mac

#139

Post by easton »

jeffbee wrote: post #131
lispm wrote: post #129

Earlier quoted context omitted.

In year 37 you can't manually zap the 'PRAM' on Apple Silicon Macs.

True, but I guess 95% of mac users are still on Intel macs, are still being told by "genius" bar frontline support to reset the SMC / zap PRAM for any kind of issue, and this usually works, too. Jury is still out on whether the M1 auto-zapping architecture is better, or will just be more prone to being permanently messed up.

Well, the fact that nobody ever has to zap PRAM on an iOS device means that they’ve probably fixed that (or, since you can’t zap PRAM anymore, people just restore the device instead...)
Post reply on HN