Using Mac Touch ID to Authenticate Sudo

Touch ID is one of the greatest things on my MacBook. I can authenticate a lot of stuff just by resting my finger on it. I can log in to any website using either passkey or the built-in password manager quickly too.

I wish I could use it from Terminal though. It would be super convenient if I could use Touch ID to authenticate sudo when executing a terminal command.

By default, macOS will ask for your password whenever you execute a command with sudo. But did you know that macOS actually supports Touch ID to authenticate sudo? I didn’t know, but the feature is there. You just need to update the config file.

The solution is quite simple. To use Touch ID to authenticate sudo, you need to edit the /etc/pam.d/sudo file.

Just for reference, here’s the default content on my macOS 27 Golden Gate (might differ for each macOS version).

$ cat /etc/pam.d/sudo
# sudo: auth account password session
auth       include        sudo_local
auth       sufficient     pam_smartcard.so
auth       required       pam_opendirectory.so
account    required       pam_permit.so
password   required       pam_deny.so
session    required       pam_permit.so

Now let’s add a new config that will use Touch ID to authenticate sudo. Open Terminal.app and edit using vim or any other text editor. You need to use sudo to edit the file.

sudo -E vim /etc/pam.d/sudo

Add the following line at the top of the config file.

auth       sufficient     pam_tid.so

Save the new changes. In my case, the new /etc/pam.d/sudo config will look like this:

auth       sufficient     pam_tid.so
auth       include        sudo_local
auth       sufficient     pam_smartcard.so
auth       required       pam_opendirectory.so
account    required       pam_permit.so
password   required       pam_deny.so
session    required       pam_permit.so

Once it’s done, open a new Terminal session and test it. Execute something with sudo; you can try something simple like:

sudo ls -lah ~

This time, a Touch ID dialog will show up, and you can authenticate it using your fingerprint instead of entering your password manually.

Another alternative is to use mole to configure Touch ID for sudo. You can first install mole using brew.

brew install mole

Then execute the following command and follow the instructions.

mo touchid

That’s it; mole will add the configuration automatically, similar to the manual method above.

That’s all I can write for today. Thanks for reading, and see you in my next post.