To wrap up Andy and Glenjamin's solution into one play:
---
- hosts: localhost
tasks:
- name: install pam_reattach pam module
homebrew:
name: fabianishere/personal/pam_reattach
state: present
register: reattach_result
- name: detect touch id support
shell: pgrep ControlStrip
ignore_errors: true
register: touch_id_result
- name: enable touch id for sudo commands
lineinfile:
path: /etc/pam.d/sudo
line: 'auth sufficient pam_tid.so'
insertbefore: '^auth sufficient pam_smartcard.so$'
become: yes
when: touch_id_result.rc == 0 and touch_id_result.stdout != ''
- name: enable persistent touch id for tmux and iterm
lineinfile:
path: /etc/pam.d/sudo
line: 'auth optional pam_reattach.so'
insertbefore: '^auth sufficient pam_tid.so$'
become: yes
when: reattach_result == 0
This can be ran with just ansible-playbook sudo-touchid.yml
, where sudo-touchid.yml
is what I named this play.
The first step installs Fabian's pam_reatttach
, that allows sudo to work in iTerm, tmux, etc. It isn't in the default brew, so we're fetching it from his own branch.
The second checks to see if this Mac has a touchbar, otherwise we're going to bail out.
Third, we're seeing if we already added pam_tid.so
to /etc/pam.d/sudo
, and only if there is a touchbar.
Finally, we also add pam_reattach.so
as an optional
auth method. According to the author, he might have have some unknown bug, and if we used required
it could result in a lockout.