Comments (12)
glad to know I'm not the only one it works "out-of-the-box" for..
In conclusion: This plugin is NOT REQUIRED on macOS Sonoma, enabling the STOCK pam_tid.so will trigger both Touch ID and Apple Watch for sudo
authentication..
from pam-watchid.
Taking a quick look at the source of pam_tid.so
it seems it only applies to Touch ID (kLAPolicyDeviceOwnerAuthenticationWithBiometrics
) and not Apple Watch (kLAPolicyDeviceOwnerAuthenticationWithBiometricsOrWatch
). Unless the version distributed in macOS is different from the published sources and does in fact work with a watch, it seems this issue isn't currently applicable here. It is however very relevant to our upstream, so make take a look there.
from pam-watchid.
it does trigger my Apple Watch for permission when I attempt to sudo (with the stock pam_tid.so added in the stock sudo_local)..
from pam-watchid.
It does not trigger my watch for authentication using the standard sudo_local config. It only triggers touchid.
Edit: Adding this plugin and enabling it in sudo_local breaks sudo completely, though.
sudo: unable to initialize PAM: No such file or directory
from pam-watchid.
yep, it works, following https://sixcolors.com/post/2023/08/in-macos-sonoma-touch-id-for-sudo-can-survive-updates/ , running sudo
triggers both Apple watch and Touch ID at the same time, so you can auth using which ever you can reach first, hella convenient
echo "auth sufficient pam_tid.so" | sudo tee -a /etc/pam.d/sudo_local
open new shell and try sudo su
Copying the steps here for posterity
BY DAN MOREN
August 18, 2023 5:33 AM PT
■ MACOS SONOMA
In macOS Sonoma, Touch ID for sudo can survive updates
One of the great things about having a Mac with built-in biometric authentication is not having to constantly type in your password. It’s particularly nice for those of us that work in Terminal, where you can set up Touch ID to authenticate the sudo command that bestows administrative powers.
However there’s been one drawback to enabling that feature: because it means altering a system file, the change wouldn’t generally survive a system update—the file would get overwritten by the stock file every time macOS released a new version, meaning you’d have to go in and make the change again. I’m probably not alone in having given up on having Touch ID enabled, rather than playing the constant cat-and-mouse game.
But wait, there’s good news: in macOS Sonoma, Apple appears to have provided a new framework to work around this problem. As Mastodon user Rachel pointed out, Sonoma allows for an additional file that will persist through updates. So you can make the change once and it should stick.
From what I can tell, this system was put in place precisely for this feature. Apple provides a sudo_local.template file as an example, which not only contains a comment explaining that sudo_local will survive updates, but also even includes the code necessary to enable Touch ID.
So, without further adieu, here are the steps for enabling this feature in macOS Sonoma, once and for all:
Open the Terminal app. Navigate to the directory that stores the authentication files by typing the following:
cd /etc/pam.d
Next, copy Apple’s provided template to the actual file that the system will read. You’ll need to use sudo and enter your administrator password to get permission:
sudo cp sudo_local.template sudo_local
Finally, open up the file you just made using your text editor of choice; I prefer pico. You’ll need to use sudo again here.
sudo pico sudo_local
In that file, navigate to the line that contains with pam_tid.so and delete the hashtag (#) at the beginning. Save the file out by pressing Control-X, typing ‘Y’ to save your changes, and hitting Return.
That’s it; you’re done! We’ll have to wait and see if this truly works as described, but fingers crossed you should be able to keep Touch ID access for sudo for ever and ever.
[Dan Moren is the East Coast Bureau Chief of Six Colors. You can find him on Mastodon at @[email protected] or reach him by email at [email protected]. His latest novel, the supernatural detective story All Souls Lost, is out now.]
If you appreciate articles like this one, support us by becoming a Six Colors subscriber. Subscribers get access to an exclusive podcast, members-only stories, and a special community.
from pam-watchid.
There is a 1/2 second gap between the touch-id popup and Apple watch, which does make sense give its two different devices connected over Bluetooth.
from pam-watchid.
This plugin is NOT REQUIRED on macOS Sonoma, enabling the STOCK pam_tid.so will trigger both Touch ID and Apple Watch for
sudo
authentication..
Does it work when the MacBook is in clamshell mode (lid closed)?
from pam-watchid.
I can confirm just enabling pam_tid.so works for Apple Watch Touch ID, but only if you've enabled this in:
System Settings.app -> Touch ID & Password -> Apple Watch: Use Apple Watch to unlock your applications and Mac
Can't test what happens with the clamshell closed because I don't have an external display and am on battery right now, which means I can't prevent the machine from going to sleep before triggering sudo -v
after a delay.
from pam-watchid.
This plugin is NOT REQUIRED on macOS Sonoma, enabling the STOCK pam_tid.so will trigger both Touch ID and Apple Watch for
sudo
authentication..Does it work when the MacBook is in clamshell mode (lid closed)?
On a related note, does it work on Macs without Touch ID
from pam-watchid.
Does it work when the MacBook is in clamshell mode (lid closed)?
I've just tested this. It does not.
from pam-watchid.
After further testing this morning, I realized that my issue is that it doesn’t do the watch when in clamshell mode because it senses there’s no TouchID so it does nothing. It does, however, do the watch when TouchID is available, but I never noticed because I don’t use it that way much and TouchID pops up first.
from pam-watchid.
These are my observations too. I think this suggestion above (#26 (comment)) will probably work from clamshell, but I've not tested yet.
from pam-watchid.
Related Issues (14)
- brew installation HOT 3
- Fails to Build on Apple Silicon HOT 1
- pam.d/sudo FORWARDING?
- stop working on 11.1 (20C69)
- TARGET auto detection
- macOS BS 11.3 beta 3 issue ... HOT 3
- macOS Big Sur 11.2.2 HOT 3
- Check if auth request is from remote session (like ssh)
- Asks for password and watch HOT 2
- Change to pam.d config file overwritten everytime macOS is updated HOT 8
- Operation not permitted. HOT 8
- Doesn't work on new macOS big sur HOT 16
- Unknown policy: '4' error under Mojave 10.14.6 (18G5033) HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from pam-watchid.