Security Upgrade: Simplify Your Life with Touch ID for Sudo on Mac

Stop Typing Your Sudo Password, Use Touch ID Instead

One of the greatest benefits of Touch ID on Mac is the convenience it provides for various tasks, such as making purchases, signing into apps, and unlocking the device. Now, you can also use Touch ID to authenticate as an administrator in Terminal for all sudo commands with just one tap.

How to Enable Touch ID for Sudo

1. Copy and Create New Configuration File
   • Copy the default template configuration file provided by Apple and create a new one called sudo_local:

   sudo cp /etc/pam.d/sudo_local.template /etc/pam.d/sudo_local
   

2. Edit the sudo_local File
   • Open the newly created sudo_local file with your preferred text editor (e.g., Nano):

   sudo nano /etc/pam.d/sudo_local
   

3. Uncomment the Auth Line
   • Uncomment the line containing pam_tid.so by removing the #. Allow any system prompts that may appear.
4. Verify the Setup
   • Open a new Terminal session and run a sudo command to test the setup. You should now get a prompt to use Touch ID for authentication instead of typing your password.

Security Note

Apple stores Touch ID data locally with AES-256 encryption in the Secure Enclave, ensuring that it is never sent to Apple servers or backed up to iCloud. The Secure Enclave only returns a 'yes' or 'no' if the authentication is successful.