13 ms·

Use TouchID to Authenticate Sudo on macOS

340 points by DerekBickerton 4y ago

jarym 4y ago
I wonder why Apple haven't made this a default on TouchID Macs?
- lelandfe 4y ago
  I mean, practically - probably not a ton of demand for a cooler, better `sudo`
  - blowski 4y ago
    I see this post pop up often so I think there's demand. But Apple only cares about solutions that make money, and this one doesn't. With Apple, I'd expect them more to block free solutions, and require an iCloud subscription to enable it.
    - Jtsummers 4y ago
      Is this just anti-Apple nonsense, trolling, or do you really believe that Apple would add an iCloud requirement to enable auth via fingerprint reader (an authentication method that already works for many other things without an iCloud subscription)?
    - yyyk 4y ago
      I tend to be critical of Apple, but the spectre of them charging for sudo is absurd. I suspect that the actual reason is boring: This is a developer oriented feature and these features aren't judged as important as other stuff.
- dhosek 4y ago
  Probably because a lot of damage can be done with sudo.
  - dmitriid 4y ago
    More than with Touch ID/Face ID that are used in a shit ton of places?
    - dhosek 4y ago
      Yeah, one of the things I did once was use sudo emacs to edit the sudoers file (I didn’t know better) and in the process locked myself out of sudo.¹ With sudo you can muck up a lot of permissions/security that shouldn’t get mucked and backing out of that can be challenging. ⸻ 1. I was able to fix it using Repair Permissions in DiskUtil. If I were running Linux I don’t know that I could have fixed it at all, although maybe Linux is more forgiving of this sort of sin?
      - GekkePrutser 4y ago
        This is why you have visudo which checks your changes before saving. Ps just mentioning it in case you didn't know about it. I know there's still ways to lock yourself out that visudo doesn't catch.
        dhosek 4y ago
        The command back when I did this was sudoedit but I didn't know better, although I don't think it did any checking of the file for validity, just made sure that the correct permissions were in place when I was done. Now, the default sudoers file on MacOS has a comment saying to edit with visudo. But there are enough footguns possible with sudo that any friction to using it is a good thing.
- deleted 4y ago
  [deleted]
- matthewfcarlson 4y ago
  I believe it makes ssh not work great since if you ssh into the machine and do sudo, there’s no way to put your finger on the sensor
  - Analemma_ 4y ago
    macOS already does fallback for this just fine: if an application requests authentication with the Secure Enclave, I'm prompted to touch the touch ID sensor if my laptop is open, but if it's closed and I'm using a docking station, it just asks for my password instead. No reason why remote ssh can't work the same way.
makeworld 4y ago
I've also done this on my Framework laptop running Linux, it's really convenient. Have it set up for sudo, user login, etc. Just added this to various files in /etc/pam.d auth sufficient pam_fprintd.so
- kitsunesoba 4y ago
  On my ThinkPad X1 Nano, GNOME under Fedora 35 and 36 offer the ability to use the fingerprint sensor for login and sudo in the Settings app. Pretty nice.
- dna_polymerase 4y ago
  Lol, just learned my laptop has a fingerprint reader.
- microtonal 4y ago
  I tried this just over a year ago, but it is quite flakey. IIRC because of how PAM works, you have to wait until this PAM module times out before you can switch to another form of authentication. (E.g. because fingerprint authentication fails.)
- ConfuSomu 4y ago
  This nicely did the trick! Adding the line at the top of /etc/pam.d/system-auth makes sudo authenticate use the fingerprint, which is nicer than always typing my password and gives a streamlined experience between SDDM and sudo.
epistasis 4y ago
Not exactly connected but the same crowd interested in this topic may also be interested in this tool to store SSH private keys in the Secure Enclave, kind of like what can be done with a YubiKey: https://github.com/maxgoedjen/secretive https://github.com/maxgoedjen/secretive I've been looking for something like this for 3-4 years but only found it six months ago (in an HN thread). I use separate keys for every use case, and now know every time a key is used for any purpose, whether it's connecting to source control or my text editor is connecting to a remote VM. Only thing I haven't figured out is how to do git signatures with these sorts of keys, but I haven't debugged it at all.
- maxique 4y ago
  I think 1Password's SSH agent does this now, too
  - CharlesW 4y ago
    I didn’t know that was a thing, thank you! https://blog.1password.com/1password-ssh-agent/ https://blog.1password.com/1password-ssh-agent/
  - microtonal 4y ago
    But it’s not really the same. Having private key material in the secure enclave means that it’s not extractable (except perhaps by state-level attackers with hardware access). With an SSH private key in 1Password there are still many possible software-level attack vectors (vulnerabilities in 1Password, a compromised 1Password update, etc.).
- kitsunesoba 4y ago
  Secretive is great. I use it on my T2 and M-series Macs and feel much better with keys sitting in those machines' secure enclaves than I did back when it was just sitting in ~/.ssh/ for anything to grab. I just wish there were something as clean as Secretive for using generic PC TPMs or YubiKeys in place of a Secure Enclave under Windows and Linux. Currently have a Linux laptop halfway through setting that up and it's messy in comparison.
maxique 4y ago
> Keep in mind that this file is somewhat protected by macOS so after each OS update you will need to add the line to the file. Other than that, it works perfectly! TIL, I wondered why every time I did this it would reset after a while. Thanks!
- latchkey 4y ago
  I've been wanting to write a simple script or app that just runs on startup to check for and fix this, but I've been so lazy. It is just too easy to edit the file and move on...
  - jackson1442 4y ago
    I'm even lazier, stole another commenter's script and just have it run on reboot. Is it idempotent? No, every reboot it adds the line again. Doesn't appear to matter though.
    - eevilspock 4y ago
      I would never be so cavalier about a security related thing such as this. See my other reply on this thread.
- shinzui 4y ago
  I use nix-darwin to automate that.
  - linsomniac 4y ago
    More details please.
    - shinzui 4y ago
      nix-darwin currently does not support that directly, but there is an open PR to fix that. For my dotfiles, I added the module from the PR with some slight modifications. You can find the code below. https://github.com/shinzui/dotfiles.nix/blob/master/modules/darwin/pam.nix https://github.com/shinzui/dotfiles.nix/blob/master/modules/...
dixie_land 4y ago
After this setup. What happens when you SSH onto your Mac and run sudo?
- impoppy 4y ago
  It is just an additional authentication mechanism to a list of various ones. If the client (COM port terminal, KVM terminal, SSH client, bare /dev/tty or any other client you can think of) does not support this mechanism, it will go for another one. UPD: https://en.m.wikipedia.org/wiki/Linux_PAM https://en.m.wikipedia.org/wiki/Linux_PAM
- JLCarveth 4y ago
  Just tried this. It asks for your password via the terminal as usual.
  - nullbyte808 4y ago
    You have to put it below the first line, like in the example.
    - JLCarveth 4y ago
      Huh? I know that. I read the article myself. I was answering OP who was asking "What happens when you SSH onto your Mac and run sudo?".
impoppy 4y ago
Fun fact: if your laptop has an IR camera, you can also use face recognition for that purpose.
- vonseel 4y ago
  More details? Is that an included auth mechanism with MacBooks or something you can install from GitHub?
  - impoppy 4y ago
    https://github.com/boltgolt/howdy https://github.com/boltgolt/howdy Never heard of similar stuff for Macs, this is Linux software. Worked fine on my ThinkPad laptop running Fedora.
loeg 4y ago
Everyone does this, right? It's super convenient except that macOS nukes the pam.d config file every update.
- tokinonagare 4y ago
  No. I only use sudo in "sudo su" once in a while when I need a root shell (sometimes not even on the local machine), then does everything within that shell. I don't understand people bothering themselves with that command. I also find egregious tutorials in which each command is prefixed with sudo.
  - vbezhenar 4y ago
    sudo -i
  - jeffhuys 4y ago
    Personally, I tend to forget that I'm in a root shell. Also, I don't want to _be_ in a root shell for more than one command unless absolutely necessary. Also also, prefixing commands with `sudo` that need `sudo` shows the potential dangers such command comes with.
jph00 4y ago
Here's a single line you can run that'll add the needed line to the file in the correct place for you: sudo perl -pi -e 's/(pam_smartcard.so)/$1\nauth sufficient pam_tid.so/' /etc/pam.d/sudo
- ayewo 4y ago
  Thanks for sharing. While tweaking the formatting, I accidentally introduced a typo which led to me spending a few minutes hunting for a fix for "sudo: unable to initialize PAM: No such process" without having to reboot :( Anyway, here's the version of your one-liner I used to preserve the spacing used in the rest of the file: sudo perl -pi -e 's/(pam_smartcard.so)/$1\nauth sufficient pam_tid.so/' /etc/pam.d/sudo
- gnubison 4y ago
  Or something like printf '%s\n' '/pam_smartcard\.so/a' 'auth sufficient pam_tid.so' . wq | sudo ex -s /etc/pam.d/sudo
r0m4n0 4y ago
Not to knock on this too hard because it seems cool and useful for 98% of people out there but touch id does have an unfixable vulnerability. If you are security obsessive, maybe no touchid altogether on your mac (I use a token). https://arstechnica.com/information-technology/2020/10/apples-t2-security-chip-has-an-unfixable-flaw/ https://arstechnica.com/information-technology/2020/10/apple...
- jolux 4y ago
  What about on apple silicon macs?
  - olliej 4y ago
    Seems like not (but I was just doing lightweight googling out of the same curiosity), the last exploitable generation of AS was iPhone X, which I _think_ predates the AS macs. Also as far as I understand exploitation would require physical access to the target device.
- muricula 4y ago
  I'm fairly sure that checkm8 doesn't affect apple silicon macs.
- olliej 4y ago
  Happily the exploit doesn’t exist in any of the arm macs. That said the checkm8 exploit requires (as far as I’m aware) physical access to the target device, which is a fairly constrained attack vector for any real world attack. Obviously if you are at risk of such attacks though then your risk profile is _vastly_ different and the steps you need to take are also different.
- DavideNL 4y ago
  tldr; "But the T2 also contains a vulnerability, known as Checkm8, that jailbreakers have already been exploiting in Apple's A5 through A11 (2011 to 2017) mobile chipsets. Now Checkra1n, the same group that developed the tool for iOS, has released support for T2 bypass." "Computers that have the Apple T2 Security Chip": https://support.apple.com/en-us/HT208862 https://support.apple.com/en-us/HT208862
eevilspock 4y ago
Previous discussions: 2021.03.01: https://news.ycombinator.com/item?id=26302139 https://news.ycombinator.com/item?id=26302139 72 days ago: https://news.ycombinator.com/item?id=31750560 https://news.ycombinator.com/item?id=31750560
ctur 4y ago
Every MacOS update, I do run a sudo command and get the password prompt. I cancel, and instead do... sudo cp ~/Dropbox/etc-pam.d-sudo /etc/pam.d/sudo Type the password once and you're done. I've been carrying this around for quite a while. No need to edit the file every MacOS, just copy it. But once it did utterly go south when Dropbox's "load files on demand" functionality replaced the file with a bunch of zero bytes. That wasn't fun to fix. So maybe Dropbox isn't the best storage place.
- jonhohle 4y ago
  Consider storing a diff instead of replacing the file completely. If the patch fails (either because the diff is all zeros or the file has changed in some material way), you can proceed with the appropriate fix.
DavideNL 4y ago
For some reason this often doesn't work for me; it seems to randomly only respond to my Watch to authenticate this, but not TouchID...
kelnos 4y ago
I know PAM gets criticized here and there, sometimes heavily, but it's actually a super flexible system. The thing that really stands out is that no application actually needs to know about all the various authentication methods possible. That file in /etc/pam.d/ just corresponds to the app's "service name", and you (as the machine administrator) can put in it whatever you want. The app just needs to go "Hey PAM, I want to start authentication using service 'sudo'", and then PAM will send instructions to the app, like "Display the text 'Place your finger on the fingerprint scanner'", or "Display the text 'Password:' and then prompt for masked input". It's really quite flexible, and despite its age, still works pretty well with current programming paradigms, whether your UI is text or graphical or whatever. The one oddity is that when it asks you to prompt for some kind of user input, it will actually expect you to return the resulting input from the same callback function. So if you're using a modern-ish GUI toolkit, you'll need to run the PAM stuff off on a different thread that's allowed to block while your UI thread is free to do what it needs to do. But overall that's just... fine?
- chatmasta 4y ago
  The API for “Pluggable Authentication Modules” (PAM) seems to be earning its name. It’s an ideal adapter layer for adding interoperable authentication to any program. And since so many programs already consume it, it’s a natural target for new authentication providers to implement. If a backend can serialize its authentication model to users and groups, then it can give those lists to a program that consumes them through PAM to authenticate users and authorize actions. Thanks to open standards (really POSIX in this case), even a small program can immediately benefit from PAM authentication because it will work in any organizational environment, regardless of whatever over-engineered backend system (like LDAP or Kerberos) or SaaS (like Okta or O365) is providing the list of users and groups.
  - KMnO4 4y ago
    I was really hoping the article would have explained a bit about PAM. Any high school English teacher can Google instructions for enabling sudo with Touch ID, but I’ve come to expect HN posts to have a higher pedigree.
inickt 4y ago
Does watch unlock now work natively with pam_tid? I know as of at least a few months ago it would only work if you could use touch ID, i.e. when the laptop was open. If it was docked, it would fall back to password auth. I wrote a patcher that changed this behavior, it patched pam_tid directly on your system and just updates the API Apple calls to allow unlocking with watch-only when touch ID is unavailable: https://github.com/inickt/pam_wtid https://github.com/inickt/pam_wtid Was a fun reverse engineering experience and wrote up some more info in the README.
- apetrovic 4y ago
  I'm using this to authorize sudo (and other things) with Apple Watch: https://github.com/insidegui/pam-watchid https://github.com/insidegui/pam-watchid ... and my /etc/pam.d/sudo needs to be changed like this: # sudo: auth account password session auth sufficient pam_watchid.so (...) This needs to be applied after every system update. Apart of that, it works really well (I have very dry skin so touch ID works for me 50% on a good day)
  - inickt 4y ago
    Guilherme’s stuff is great. pam-watchid is a reimplementation of Apple’s pam_touchid, but uses the other authentication flag which I patch in to the original binary.
computing 4y ago
To get this to work inside of tmux sessions use this: https://github.com/fabianishere/pam_reattach https://github.com/fabianishere/pam_reattach
rez9x 4y ago
I like that you can do this and appreciate the knowledge, but it seems slower than just typing in your password, and kind of breaks my flow by removing my hand from the home row.
- vonseel 4y ago
  That depends on how long your password is I guess. I much prefer Touch ID personally it probably takes about the same time as typing my password but there’s no chance of a mistake or typo. It’s pretty seamless in my experience.
can16358p 4y ago
I never understood why this isn't enabled by default in the first place.
path_to_file 4y ago
In the same vein, I recently made a tool to use TouchID and the Secure Enclave to protect arbitrary data and env variables from the commandline: https://github.com/pathtofile/toucli https://github.com/pathtofile/toucli
gumby 4y ago
I did this when the touch ID macs were first released and very quickly disabled it. Why? Because asking for a password for su / sudo broke the flow -- not only did I have to move my right hand from the home row (or both, for my watch), but it popped up a modal-like window away from where my eyes were. Basically it impinged on my focus. Nice idea, not so nice in practice.
- bobbylarrybobby 4y ago
  Also, with sudo, I think a lot of the value is the inconvenience of typing out a password. Having to stop and think and type is a nice guardrail that I think fingerprint-based auth would remove.
  - easton 4y ago
    The sudoers file on my Mac is configured to always show the disclaimer (and I deleted the Apple written one so it shows the original disclaimer too). It’s definitely made me stop and think once or twice before brew did something I didn’t want it to (or if I forgot which terminal I was in).
myko 4y ago
This seems like it should be default behavior
nathan_f77 4y ago
I set this up a few years ago and it's been very handy. I can also use my Apple Watch to authenticate certain things on my Mac, so I should try to set this up for sudo. Maybe my Yubikey as well. I use external monitors now and leave my MacBook closed in a dock, so it would be nice if I could use an external fingerprint reader that I plug in via USB. I guess the Yubikey is sort of like this, but it's probably not as secure as using a fingerprint.
pcthrowaway 4y ago
Either TouchID is really poor fingerprint scanner, or state of the art just sucks. As a rock climber, it stops working after even a light climbing session. Obviously there's some abrasion on the skin when one climbs, but I can't imagine it generates a new, unrecognizable fingerprint.
- hanche 4y ago
  It’s the rock climbing. See my comment here: https://news.ycombinator.com/item?id=32616371 https://news.ycombinator.com/item?id=32616371
stblack 4y ago
Except... is it just me, or is TouchID on MacOS unreliable for mostly everyone? It seems like I have a 25% success rate with TouchID. I have the same fingerprint mapped to three "fingers" and still it's awful.
- duxup 4y ago
  It is solid for me on my m2 air. I don’t think I’ve ever seen it ask for me to retry. My work profile is one finger, personal profile a different, both work great.
- camhart 4y ago
  It's not just you. I give up and enter the password a majority of the time. I have noticed if I remove my fingerprint then add it back, it's more accurate for a short time. Then over time it goes back to not working as well.
- hanche 4y ago
  My wife does a lot of garden work. When she set up TouchID in the winter, it worked fine – until the gardening season started. Then it gradually became more unreliable, until it stopped working altogether. Then early last fall, when she went to the police station for a new ID card, their fingerprint reader was unable to read a fingerprint from any finger. She was told that this is not uncommon for people who do garden work, rock climbing, or some other kinds of manual labour. Their fingerprints just wear down enough for the reader not to be able to read them. – But not completely. Burglars beware. ;-)
  - lostlogin 4y ago
    I was painting a lot of windows and between paint, sandpaper and various minor injuries, Touch ID didn’t work reliably. I set my nose as a finger and I t worked.
- Toutouxc 4y ago
  I've noticed people saying this over on MacRumors, but my experience is exactly the opposite. I have a single finger set up as a single fingerprint, on a M1 Air, and it's been 100 % since I got the machine 20 months ago. Like literally 100 %, I don't think I've ever had to touch the sensor twice or wait more than half a second. PS: My hands don't sweat much and I keep the keyboard clean and without dust.
a-dub 4y ago
i remember this was possible on thinkpads and linux with a custom pam library like ten years ago. it was fun to set up, but not really worth maintaining.
ghoward 4y ago
I guess this is as good a time to ask as any. Is it possible for a process to authenticate a user without root privileges, including setuid/setgid?
simonebrunozzi 4y ago
Not a great idea, and also not good to use TouchID in general. If you're really keen on having a high level of security, the fact that someone can easily force your finger to unlock your Mac is not great. You don't even need to be conscious to allow ill-intentioned people to take advantage of it. I wish Mac OS would allow the use of a "stress" fingerprint, e.g. right index fingerprint is to use when you're under duress, while instead another fingerprint is for normal use.
- Sharparam 4y ago
  Not a Mac user, but on my Linux system i require password + yubikey (U2F/WebAuthN) for logging in, but then fingerprint is sufficient for sudo (or U2F alone on my desktop which doesn't have a fingerprint reader). I typically lock my system when away from it so having fingerprint sufficient for sudo doesn't seem so bad.
thefabsta 4y ago
Note that the order of the lines in /etc/pam.d/sudo matters. Add the "auth sufficient pam_tid.so" line below the pam_smartcard.so line as shown in the article for this to work correctly.
- bouncing 4y ago
  Mine doesn't have a pam_smartcard.so line(?)... It has pam_rootok.so, but adding below that doesn't work. Odd.
nigerian1981 4y ago
Annoyingly my company monitors changes to the file and last time I tried this I got a message a few minutes later asking what I’d been doing. They did let me keep the change once I’d explained.
Grandmother 4y ago
Fingerprints can be hacked https://news.ycombinator.com/item?id=29306163 https://news.ycombinator.com/item?id=29306163
Thoughtful 4y ago
Interestingly, making this change can trigger a CrowdStrike "privilege escalation" alert.
GekkePrutser 4y ago
I never understood why Apple doesn't do this by default, after all you can elevate to admin by fingerprint in the UI. And like others said, it doesn't persist anymore. I also edited the sshd_config to enforce public key Auth but this was getting annoying. I use FreeBSD now which lets me use my computer the way I want to.

I wonder why Apple haven't made this a default on TouchID Macs?

lelandfe 4y ago
I mean, practically - probably not a ton of demand for a cooler, better `sudo`
- blowski 4y ago
  I see this post pop up often so I think there's demand. But Apple only cares about solutions that make money, and this one doesn't. With Apple, I'd expect them more to block free solutions, and require an iCloud subscription to enable it.
  - Jtsummers 4y ago
    Is this just anti-Apple nonsense, trolling, or do you really believe that Apple would add an iCloud requirement to enable auth via fingerprint reader (an authentication method that already works for many other things without an iCloud subscription)?
  - yyyk 4y ago
    I tend to be critical of Apple, but the spectre of them charging for sudo is absurd. I suspect that the actual reason is boring: This is a developer oriented feature and these features aren't judged as important as other stuff.
dhosek 4y ago
Probably because a lot of damage can be done with sudo.
- dmitriid 4y ago
  More than with Touch ID/Face ID that are used in a shit ton of places?
  - dhosek 4y ago
    Yeah, one of the things I did once was use sudo emacs to edit the sudoers file (I didn’t know better) and in the process locked myself out of sudo.¹ With sudo you can muck up a lot of permissions/security that shouldn’t get mucked and backing out of that can be challenging. ⸻ 1. I was able to fix it using Repair Permissions in DiskUtil. If I were running Linux I don’t know that I could have fixed it at all, although maybe Linux is more forgiving of this sort of sin?
    - GekkePrutser 4y ago
      This is why you have visudo which checks your changes before saving. Ps just mentioning it in case you didn't know about it. I know there's still ways to lock yourself out that visudo doesn't catch.
      - dhosek 4y ago
        The command back when I did this was sudoedit but I didn't know better, although I don't think it did any checking of the file for validity, just made sure that the correct permissions were in place when I was done. Now, the default sudoers file on MacOS has a comment saying to edit with visudo. But there are enough footguns possible with sudo that any friction to using it is a good thing.
deleted 4y ago
[deleted]
matthewfcarlson 4y ago
I believe it makes ssh not work great since if you ssh into the machine and do sudo, there’s no way to put your finger on the sensor
- Analemma_ 4y ago
  macOS already does fallback for this just fine: if an application requests authentication with the Secure Enclave, I'm prompted to touch the touch ID sensor if my laptop is open, but if it's closed and I'm using a docking station, it just asks for my password instead. No reason why remote ssh can't work the same way.

I've also done this on my Framework laptop running Linux, it's really convenient. Have it set up for sudo, user login, etc. Just added this to various files in /etc/pam.d auth sufficient pam_fprintd.so

kitsunesoba 4y ago
On my ThinkPad X1 Nano, GNOME under Fedora 35 and 36 offer the ability to use the fingerprint sensor for login and sudo in the Settings app. Pretty nice.
dna_polymerase 4y ago
Lol, just learned my laptop has a fingerprint reader.
microtonal 4y ago
I tried this just over a year ago, but it is quite flakey. IIRC because of how PAM works, you have to wait until this PAM module times out before you can switch to another form of authentication. (E.g. because fingerprint authentication fails.)
ConfuSomu 4y ago
This nicely did the trick! Adding the line at the top of /etc/pam.d/system-auth makes sudo authenticate use the fingerprint, which is nicer than always typing my password and gives a streamlined experience between SDDM and sudo.

epistasis 4y ago

Not exactly connected but the same crowd interested in this topic may also be interested in this tool to store SSH private keys in the Secure Enclave, kind of like what can be done with a YubiKey: https://github.com/maxgoedjen/secretive https://github.com/maxgoedjen/secretive I've been looking for something like this for 3-4 years but only found it six months ago (in an HN thread). I use separate keys for every use case, and now know every time a key is used for any purpose, whether it's connecting to source control or my text editor is connecting to a remote VM. Only thing I haven't figured out is how to do git signatures with these sorts of keys, but I haven't debugged it at all.

maxique 4y ago
I think 1Password's SSH agent does this now, too
- CharlesW 4y ago
  I didn’t know that was a thing, thank you! https://blog.1password.com/1password-ssh-agent/ https://blog.1password.com/1password-ssh-agent/
- microtonal 4y ago
  But it’s not really the same. Having private key material in the secure enclave means that it’s not extractable (except perhaps by state-level attackers with hardware access). With an SSH private key in 1Password there are still many possible software-level attack vectors (vulnerabilities in 1Password, a compromised 1Password update, etc.).
kitsunesoba 4y ago
Secretive is great. I use it on my T2 and M-series Macs and feel much better with keys sitting in those machines' secure enclaves than I did back when it was just sitting in ~/.ssh/ for anything to grab. I just wish there were something as clean as Secretive for using generic PC TPMs or YubiKeys in place of a Secure Enclave under Windows and Linux. Currently have a Linux laptop halfway through setting that up and it's messy in comparison.

maxique 4y ago

> Keep in mind that this file is somewhat protected by macOS so after each OS update you will need to add the line to the file. Other than that, it works perfectly! TIL, I wondered why every time I did this it would reset after a while. Thanks!

latchkey 4y ago
I've been wanting to write a simple script or app that just runs on startup to check for and fix this, but I've been so lazy. It is just too easy to edit the file and move on...
- jackson1442 4y ago
  I'm even lazier, stole another commenter's script and just have it run on reboot. Is it idempotent? No, every reboot it adds the line again. Doesn't appear to matter though.
  - eevilspock 4y ago
    I would never be so cavalier about a security related thing such as this. See my other reply on this thread.
shinzui 4y ago
I use nix-darwin to automate that.
- linsomniac 4y ago
  More details please.
  - shinzui 4y ago
    nix-darwin currently does not support that directly, but there is an open PR to fix that. For my dotfiles, I added the module from the PR with some slight modifications. You can find the code below. https://github.com/shinzui/dotfiles.nix/blob/master/modules/darwin/pam.nix https://github.com/shinzui/dotfiles.nix/blob/master/modules/...

dixie_land 4y ago

After this setup. What happens when you SSH onto your Mac and run sudo?

impoppy 4y ago
It is just an additional authentication mechanism to a list of various ones. If the client (COM port terminal, KVM terminal, SSH client, bare /dev/tty or any other client you can think of) does not support this mechanism, it will go for another one. UPD: https://en.m.wikipedia.org/wiki/Linux_PAM https://en.m.wikipedia.org/wiki/Linux_PAM
JLCarveth 4y ago
Just tried this. It asks for your password via the terminal as usual.
- nullbyte808 4y ago
  You have to put it below the first line, like in the example.
  - JLCarveth 4y ago
    Huh? I know that. I read the article myself. I was answering OP who was asking "What happens when you SSH onto your Mac and run sudo?".

impoppy 4y ago

Fun fact: if your laptop has an IR camera, you can also use face recognition for that purpose.

vonseel 4y ago
More details? Is that an included auth mechanism with MacBooks or something you can install from GitHub?
- impoppy 4y ago
  https://github.com/boltgolt/howdy https://github.com/boltgolt/howdy Never heard of similar stuff for Macs, this is Linux software. Worked fine on my ThinkPad laptop running Fedora.

loeg 4y ago

Everyone does this, right? It's super convenient except that macOS nukes the pam.d config file every update.

tokinonagare 4y ago
No. I only use sudo in "sudo su" once in a while when I need a root shell (sometimes not even on the local machine), then does everything within that shell. I don't understand people bothering themselves with that command. I also find egregious tutorials in which each command is prefixed with sudo.
- vbezhenar 4y ago
  sudo -i
- jeffhuys 4y ago
  Personally, I tend to forget that I'm in a root shell. Also, I don't want to _be_ in a root shell for more than one command unless absolutely necessary. Also also, prefixing commands with `sudo` that need `sudo` shows the potential dangers such command comes with.

jph00 4y ago

Here's a single line you can run that'll add the needed line to the file in the correct place for you: sudo perl -pi -e 's/(pam_smartcard.so)/$1\nauth sufficient pam_tid.so/' /etc/pam.d/sudo

ayewo 4y ago
Thanks for sharing. While tweaking the formatting, I accidentally introduced a typo which led to me spending a few minutes hunting for a fix for "sudo: unable to initialize PAM: No such process" without having to reboot :( Anyway, here's the version of your one-liner I used to preserve the spacing used in the rest of the file: sudo perl -pi -e 's/(pam_smartcard.so)/$1\nauth sufficient pam_tid.so/' /etc/pam.d/sudo
gnubison 4y ago
Or something like printf '%s\n' '/pam_smartcard\.so/a' 'auth sufficient pam_tid.so' . wq | sudo ex -s /etc/pam.d/sudo

r0m4n0 4y ago

Not to knock on this too hard because it seems cool and useful for 98% of people out there but touch id does have an unfixable vulnerability. If you are security obsessive, maybe no touchid altogether on your mac (I use a token). https://arstechnica.com/information-technology/2020/10/apples-t2-security-chip-has-an-unfixable-flaw/ https://arstechnica.com/information-technology/2020/10/apple...

jolux 4y ago
What about on apple silicon macs?
- olliej 4y ago
  Seems like not (but I was just doing lightweight googling out of the same curiosity), the last exploitable generation of AS was iPhone X, which I _think_ predates the AS macs. Also as far as I understand exploitation would require physical access to the target device.
muricula 4y ago
I'm fairly sure that checkm8 doesn't affect apple silicon macs.
olliej 4y ago
Happily the exploit doesn’t exist in any of the arm macs. That said the checkm8 exploit requires (as far as I’m aware) physical access to the target device, which is a fairly constrained attack vector for any real world attack. Obviously if you are at risk of such attacks though then your risk profile is _vastly_ different and the steps you need to take are also different.
DavideNL 4y ago
tldr; "But the T2 also contains a vulnerability, known as Checkm8, that jailbreakers have already been exploiting in Apple's A5 through A11 (2011 to 2017) mobile chipsets. Now Checkra1n, the same group that developed the tool for iOS, has released support for T2 bypass." "Computers that have the Apple T2 Security Chip": https://support.apple.com/en-us/HT208862 https://support.apple.com/en-us/HT208862

eevilspock 4y ago

Previous discussions: 2021.03.01: https://news.ycombinator.com/item?id=26302139 https://news.ycombinator.com/item?id=26302139 72 days ago: https://news.ycombinator.com/item?id=31750560 https://news.ycombinator.com/item?id=31750560

ctur 4y ago

Every MacOS update, I do run a sudo command and get the password prompt. I cancel, and instead do... sudo cp ~/Dropbox/etc-pam.d-sudo /etc/pam.d/sudo Type the password once and you're done. I've been carrying this around for quite a while. No need to edit the file every MacOS, just copy it. But once it did utterly go south when Dropbox's "load files on demand" functionality replaced the file with a bunch of zero bytes. That wasn't fun to fix. So maybe Dropbox isn't the best storage place.

jonhohle 4y ago
Consider storing a diff instead of replacing the file completely. If the patch fails (either because the diff is all zeros or the file has changed in some material way), you can proceed with the appropriate fix.

DavideNL 4y ago

For some reason this often doesn't work for me; it seems to randomly only respond to my Watch to authenticate this, but not TouchID...

kelnos 4y ago

I know PAM gets criticized here and there, sometimes heavily, but it's actually a super flexible system. The thing that really stands out is that no application actually needs to know about all the various authentication methods possible. That file in /etc/pam.d/ just corresponds to the app's "service name", and you (as the machine administrator) can put in it whatever you want. The app just needs to go "Hey PAM, I want to start authentication using service 'sudo'", and then PAM will send instructions to the app, like "Display the text 'Place your finger on the fingerprint scanner'", or "Display the text 'Password:' and then prompt for masked input". It's really quite flexible, and despite its age, still works pretty well with current programming paradigms, whether your UI is text or graphical or whatever. The one oddity is that when it asks you to prompt for some kind of user input, it will actually expect you to return the resulting input from the same callback function. So if you're using a modern-ish GUI toolkit, you'll need to run the PAM stuff off on a different thread that's allowed to block while your UI thread is free to do what it needs to do. But overall that's just... fine?

chatmasta 4y ago
The API for “Pluggable Authentication Modules” (PAM) seems to be earning its name. It’s an ideal adapter layer for adding interoperable authentication to any program. And since so many programs already consume it, it’s a natural target for new authentication providers to implement. If a backend can serialize its authentication model to users and groups, then it can give those lists to a program that consumes them through PAM to authenticate users and authorize actions. Thanks to open standards (really POSIX in this case), even a small program can immediately benefit from PAM authentication because it will work in any organizational environment, regardless of whatever over-engineered backend system (like LDAP or Kerberos) or SaaS (like Okta or O365) is providing the list of users and groups.
- KMnO4 4y ago
  I was really hoping the article would have explained a bit about PAM. Any high school English teacher can Google instructions for enabling sudo with Touch ID, but I’ve come to expect HN posts to have a higher pedigree.

inickt 4y ago

Does watch unlock now work natively with pam_tid? I know as of at least a few months ago it would only work if you could use touch ID, i.e. when the laptop was open. If it was docked, it would fall back to password auth. I wrote a patcher that changed this behavior, it patched pam_tid directly on your system and just updates the API Apple calls to allow unlocking with watch-only when touch ID is unavailable: https://github.com/inickt/pam_wtid https://github.com/inickt/pam_wtid Was a fun reverse engineering experience and wrote up some more info in the README.

apetrovic 4y ago
I'm using this to authorize sudo (and other things) with Apple Watch: https://github.com/insidegui/pam-watchid https://github.com/insidegui/pam-watchid ... and my /etc/pam.d/sudo needs to be changed like this: # sudo: auth account password session auth sufficient pam_watchid.so (...) This needs to be applied after every system update. Apart of that, it works really well (I have very dry skin so touch ID works for me 50% on a good day)
- inickt 4y ago
  Guilherme’s stuff is great. pam-watchid is a reimplementation of Apple’s pam_touchid, but uses the other authentication flag which I patch in to the original binary.

computing 4y ago

To get this to work inside of tmux sessions use this: https://github.com/fabianishere/pam_reattach https://github.com/fabianishere/pam_reattach

rez9x 4y ago

I like that you can do this and appreciate the knowledge, but it seems slower than just typing in your password, and kind of breaks my flow by removing my hand from the home row.

vonseel 4y ago
That depends on how long your password is I guess. I much prefer Touch ID personally it probably takes about the same time as typing my password but there’s no chance of a mistake or typo. It’s pretty seamless in my experience.

can16358p 4y ago

I never understood why this isn't enabled by default in the first place.

path_to_file 4y ago

In the same vein, I recently made a tool to use TouchID and the Secure Enclave to protect arbitrary data and env variables from the commandline: https://github.com/pathtofile/toucli https://github.com/pathtofile/toucli

gumby 4y ago

I did this when the touch ID macs were first released and very quickly disabled it. Why? Because asking for a password for su / sudo broke the flow -- not only did I have to move my right hand from the home row (or both, for my watch), but it popped up a modal-like window away from where my eyes were. Basically it impinged on my focus. Nice idea, not so nice in practice.

bobbylarrybobby 4y ago
Also, with sudo, I think a lot of the value is the inconvenience of typing out a password. Having to stop and think and type is a nice guardrail that I think fingerprint-based auth would remove.
- easton 4y ago
  The sudoers file on my Mac is configured to always show the disclaimer (and I deleted the Apple written one so it shows the original disclaimer too). It’s definitely made me stop and think once or twice before brew did something I didn’t want it to (or if I forgot which terminal I was in).

myko 4y ago

This seems like it should be default behavior

nathan_f77 4y ago

I set this up a few years ago and it's been very handy. I can also use my Apple Watch to authenticate certain things on my Mac, so I should try to set this up for sudo. Maybe my Yubikey as well. I use external monitors now and leave my MacBook closed in a dock, so it would be nice if I could use an external fingerprint reader that I plug in via USB. I guess the Yubikey is sort of like this, but it's probably not as secure as using a fingerprint.

pcthrowaway 4y ago

Either TouchID is really poor fingerprint scanner, or state of the art just sucks. As a rock climber, it stops working after even a light climbing session. Obviously there's some abrasion on the skin when one climbs, but I can't imagine it generates a new, unrecognizable fingerprint.

hanche 4y ago
It’s the rock climbing. See my comment here: https://news.ycombinator.com/item?id=32616371 https://news.ycombinator.com/item?id=32616371

stblack 4y ago

Except... is it just me, or is TouchID on MacOS unreliable for mostly everyone? It seems like I have a 25% success rate with TouchID. I have the same fingerprint mapped to three "fingers" and still it's awful.

duxup 4y ago
It is solid for me on my m2 air. I don’t think I’ve ever seen it ask for me to retry. My work profile is one finger, personal profile a different, both work great.
camhart 4y ago
It's not just you. I give up and enter the password a majority of the time. I have noticed if I remove my fingerprint then add it back, it's more accurate for a short time. Then over time it goes back to not working as well.
hanche 4y ago
My wife does a lot of garden work. When she set up TouchID in the winter, it worked fine – until the gardening season started. Then it gradually became more unreliable, until it stopped working altogether. Then early last fall, when she went to the police station for a new ID card, their fingerprint reader was unable to read a fingerprint from any finger. She was told that this is not uncommon for people who do garden work, rock climbing, or some other kinds of manual labour. Their fingerprints just wear down enough for the reader not to be able to read them. – But not completely. Burglars beware. ;-)
- lostlogin 4y ago
  I was painting a lot of windows and between paint, sandpaper and various minor injuries, Touch ID didn’t work reliably. I set my nose as a finger and I t worked.
Toutouxc 4y ago
I've noticed people saying this over on MacRumors, but my experience is exactly the opposite. I have a single finger set up as a single fingerprint, on a M1 Air, and it's been 100 % since I got the machine 20 months ago. Like literally 100 %, I don't think I've ever had to touch the sensor twice or wait more than half a second. PS: My hands don't sweat much and I keep the keyboard clean and without dust.

a-dub 4y ago

i remember this was possible on thinkpads and linux with a custom pam library like ten years ago. it was fun to set up, but not really worth maintaining.

ghoward 4y ago

I guess this is as good a time to ask as any. Is it possible for a process to authenticate a user without root privileges, including setuid/setgid?

simonebrunozzi 4y ago

Not a great idea, and also not good to use TouchID in general. If you're really keen on having a high level of security, the fact that someone can easily force your finger to unlock your Mac is not great. You don't even need to be conscious to allow ill-intentioned people to take advantage of it. I wish Mac OS would allow the use of a "stress" fingerprint, e.g. right index fingerprint is to use when you're under duress, while instead another fingerprint is for normal use.

Sharparam 4y ago
Not a Mac user, but on my Linux system i require password + yubikey (U2F/WebAuthN) for logging in, but then fingerprint is sufficient for sudo (or U2F alone on my desktop which doesn't have a fingerprint reader). I typically lock my system when away from it so having fingerprint sufficient for sudo doesn't seem so bad.

thefabsta 4y ago

Note that the order of the lines in /etc/pam.d/sudo matters. Add the "auth sufficient pam_tid.so" line below the pam_smartcard.so line as shown in the article for this to work correctly.

bouncing 4y ago
Mine doesn't have a pam_smartcard.so line(?)... It has pam_rootok.so, but adding below that doesn't work. Odd.

nigerian1981 4y ago

Annoyingly my company monitors changes to the file and last time I tried this I got a message a few minutes later asking what I’d been doing. They did let me keep the change once I’d explained.

Grandmother 4y ago

Fingerprints can be hacked https://news.ycombinator.com/item?id=29306163 https://news.ycombinator.com/item?id=29306163

Thoughtful 4y ago

Interestingly, making this change can trigger a CrowdStrike "privilege escalation" alert.

GekkePrutser 4y ago

I never understood why Apple doesn't do this by default, after all you can elevate to admin by fingerprint in the UI. And like others said, it doesn't persist anymore. I also edited the sshd_config to enforce public key Auth but this was getting annoying. I use FreeBSD now which lets me use my computer the way I want to.