To wrap up Andy and Glenjamin's solution into one play:
---
- hosts: localhost
tasks:
- name: install pam_reattach pam module
homebrew:
name: fabianishere/personal/pam_reattach
state: present
register: reattach_result
- name: detect touch id support
shell: pgrep ControlStrip
ignore_errors: true
register: touch_id_result
- name: enable touch id for sudo commands
lineinfile:
path: /etc/pam.d/sudo
line: 'auth sufficient pam_tid.so'
insertbefore: '^auth sufficient pam_smartcard.so$'
become: yes
when: touch_id_result.rc == 0 and touch_id_result.stdout != ''
- name: enable persistent touch id for tmux and iterm
lineinfile:
path: /etc/pam.d/sudo
line: 'auth optional pam_reattach.so'
insertbefore: '^auth sufficient pam_tid.so$'
become: yes
when: reattach_result == 0
This can be run with just ansible-playbook sudo-touchid.yml
, where sudo-touchid.yml
is what I named this play.
The first step installs Fabian's pam_reattach
, which allows sudo to work in iTerm, tmux, etc. It isn't in the default Homebrew formulae, so we're fetching it from his own repository.
The second checks to see if this Mac has a touchbar; otherwise we're going to bail out.
Third, we're seeing if we already added pam_tid.so
to /etc/pam.d/sudo
, and only if there is a touchbar.
Finally, we also add pam_reattach.so
as an optional
auth method. According to the author, he might have have some unknown bug, and if we used required
it could result in a lockout.