Live data from Hacker News

Use Touch ID for Sudo on Mac

davidwalsh.name

151–160 of 221 posts

Re: Use Touch ID for Sudo on Mac

#151
post #59

Earlier quoted context omitted.

If you have a Touch ID Mac, enabling Touch ID for sudo also enables using an Apple Watch, so you can use either if you like.

If I remember rightly, this only works with the lid open.

That's correct, which typically defeats the point of using it since in that case you still have access to Touch ID. The above link works in both scenarios, and can be used as a fallback for pam_tid.

Re: Use Touch ID for Sudo on Mac

#152
post #40

Earlier quoted context omitted.

I suspect the main reason is that the face-id camera module is too thick and they'd need to increase the thickness of the display casing. If there's on thing the Mac designers will never allow it's a thicker laptop.

Based on iFixit's iPhone 12 teardown and thus the most recent version of the module, I think they might be able to get it into the screen without much compromise. An important consideration here is that it's not just about the Face ID bit, it's about the better camera bit. While it was important even earlier, this past year has made videoconferencing and other remote work rocket up in priorities, and Macs suck pretty…

> It's a big, by definition both very visible and very social feature

But you only see yourself as a thumbnail so the feedback is quite lossy.

Re: Use Touch ID for Sudo on Mac

#153
post #98

This is amazing -- but every. single. update. disables it again Why does the sudo file not persist between updates? This case is quite minor for personal computers, but what about companies that log in with yubikeys or smart cards? Do they have to reconfigure after every update too?

This is a very macOS problem. Why does it reset every preference on updates? The one that kills me is wake-on-lan, that gets turned back on regardless. Hate!

It may be an unintentional side effect, but doing this may prevent some degree of "Win rot", which Macos (and iOS) has also suffered from to a degree in the past. A huge number of mysterious iOS and Macos problems are caused by an accumulation of issues when config files of various types are "upgraded" along with the OS from one version to the next. If you look at all of the minor and major versions that come out in a year, small issues become large issues after being compounded by a couple of dozen updates.

There was an issue with iOS a few years ago that caused higher than normal battery drain when I was managing a department that supported a lot of iOS devices. A lot of users thought they needed a new battery. The battery drain issue was resolved for 100% of our users by doing an "Erase all data" and NOT restoring the backup. This process will still fix an amazing number of weird iOS issues in 2021, especially issues with the device slowing down, getting hot, or draining battery. It works because you end up with default config files that were designed for that version of the OS. If you restore the backup, often it will "restore" the problem you were trying to fix because the iOS restore process puts some OS config files back.

It will be interesting to see if Macos becomes less susceptible to win-rot type issues because of this config file reset behavior, as annoying as it may seem.

Re: Use Touch ID for Sudo on Mac

#154
post #59

Earlier quoted context omitted.

If you have a Touch ID Mac, enabling Touch ID for sudo also enables using an Apple Watch, so you can use either if you like.

If I remember rightly, this only works with the lid open.

Ah, I never use clamshell mode so I didn't know that.

Re: Use Touch ID for Sudo on Mac

#155
Having the ability to use Touch ID for sudo is handy. I’ve been using it for a while.

Coupled with `expect` I use it to authenticate through SSH (that is the only feasible option I got to connect to hosts I’ve got limited access). I even wrote about it: https://antonio-ramadas.github.io/blog/2020/10/30/ssh-login-...

Here is the gist of it:

  #!/usr/bin/expect
  
  # Connects via SSH to the host passed as argument
  
  set timeout 60
  set server [lindex $argv 0]
  set username 
  set password [exec sudo cat ]
  
  spawn ssh $username@$server
  
  expect { 
   "yes/no" { send "yes\r" ; exp_continue }
   "\*?assword" { send "$password\r" }
  }
  
  interact
Edit: Please remove all permissions from the password file with:

  chmod a-rwx 
I’m also assuming you run this script on an environment you control and trust. Be wary of your password.

Re: Use Touch ID for Sudo on Mac

#156
post #22

Interesting, I hacked a small pam module together 4 years ago for the first generation of touch id enabled macbooks[0] and I wonder if pam_tid.so was always present and I just missed it. D'oh! [0] https://github.com/spaghetti-/pam-touchid

You missed it by just a couple of months or so :)

pam_modules-159.50.4/modules/pam_tid/pam_tid.c appeared in macOS 10.12.4 https://opensource.apple.com/release/macos-10124.html

And macOS 10.12.4 was posted on Mar 27, 2017, according to https://support.apple.com/kb/DL1911

Re: Use Touch ID for Sudo on Mac

#157

This is amazing -- but every. single. update. disables it again Why does the sudo file not persist between updates? This case is quite minor for personal computers, but what about companies that log in with yubikeys or smart cards? Do they have to reconfigure after every update too?

curl -sL https://gist.githubusercontent.com/RichardBronosky/31660eb4b... | bash This helps.

Seems secure.

Re: Use Touch ID for Sudo on Mac

#158

Earlier quoted context omitted.

Why cant Apple use their TimeMachine tech to take a snapshot of the prefs on the existing, then do their image based update, then have it automatically apply the prefs from the timemachine mod-integration? The richest company in the world can't think different?

Just my opinion here, but I feel like Apple again doesn't really care about power users. 98% of their users won't be making any customizations like this, so they don't care to spend money working on those "edge cases." Their primary mission is to sell devices and apps to average people who aren't tech geeks. And I don't think Apple cares about general purpose computing. I see MacOS getting closer to iOS with every up…

Have you ever been FORCED to upgrade/update against your will for a new release whereby you say NO NO NO - then you make the mistake of falling asleep with your phone plugged into the charger to wake to a forced update to your device?

Yeah - fuck apple - and fuck Jonny Ive - they claim to be the masers of all aspects of designs, but really they're they masters of /r/assholedesign

Their hardware is in the top 70th % - but their UX is IMO (just look at how many clicks you need to do certain tasks, such as bluetooth. They have a slide-up menu to toggle BT and WIFI - but you have to go to desktop->settings->bluetooth->(toggle it on off/refresh)->find the device-> "cant connect" - Toggle BT on both phone and device -> attempt to connect...

But you cant up-swipe hit BT and have it show you the FN menu on screen.

You cant backup and manage all your prefs via icloud - such that you can apply profiles, save profiles, etc from your device to your linked cloud account and say "I always want my privacy to be thus, these are the networks I trust.

Their photos library mgmt is absolute garbage. You have no photo details available to you.

Their albums are garbage.

There are so many interactions that require like 5x more clicks than they should.

Their screens suck.

Their device accessory ecosystem sucks and punishes you for profit with impunity.

They exploit chinese slave labor.

They try to charge you for flaws in the HW provided (recall the balloon battery problem?

I had a macbook pro CATCH FIRE while I was asleep in bed. They said they "recognize that was a safety problem, but because our engineers (after two months of having the machine) determined that at one time the liquid sensor was set off, we cannot replace your machine EVEN THOUGH IT WAS UNDER RECALL FOR THE CLASS OF PROS THAT WERE RECALLED FOR CATCHING FIRE.

FUCK APPLE.

Re: Use Touch ID for Sudo on Mac

#159
What type of work or activity on macOS requires sudo repeatedly enough that it needs to be automated in this way? I mainly need sudo for the occasional dmesg or for adjusting routes after activating my VPN for work.

Re: Use Touch ID for Sudo on Mac

#160
post #143

Earlier quoted context omitted.

What if one file was written by a malicious program?

You already have to reboot into the Recovery environment and disable both System Integrity Protection (with csrutil) and OS root-volume signing (with bputil) in order to even (persistently) modify any of the files in /System now. Malware can't do that, because there's no way for any executable that runs in the regular OS—and isn't signed by Apple—to get anything to automatically happen over in the Recovery OS. (That'…

Thorough explanation, thank you.
Post reply on HN