Order matters. Lets say you already have a registered yubikey or similar smart card. The /etc/pam.d/sudo file might look like this: # sudo: auth account pass

Order matters. Lets say you already have a registered yubikey or similar smart card. The /etc/pam.d/sudo file might look like this: # sudo: auth account password session auth sufficient pam_smartcard.so auth required pam_opendirectory.so account required pam_permit.so password required pam_deny.so session required pam_permit.so So if for some reason you want to have both Touch ID and the smart card authentication as options you might want to do this: # sudo: auth account password session auth sufficient pam_smartcard.so auth sufficient pam_tid.so ... It will ask for smart card first but if a smart card is unavailable or authentication fails the touch mechanism will be requested. If you invert those parameters the order also gets changed.