• Does Touch ID for the MacBook Pro 2016 Touch Bar support elevating admin privileges in macOS?

  • Somewhat differently, can the Touch ID give sudo access in Terminal?

I'm guessing that the former may be possible, but probably not the latter since it depends on string input.

I wonder this because I'm considering getting a YubiKey which can do string input to password fields, but Touch ID for Macs may render it unnecessary.

  • 2
    check this out: github.com/mattrajca/sudo-touchid – pathikrit Nov 14 '16 at 23:37
  • @pathikrit - close but it looks like a PAM module would be a much better solution than a forked sudo. I haven't seen any that have been written yet; I may try my hand at it – Brad Dwyer Nov 16 '16 at 18:58

1) TouchID does support elevating privileges, but as of now, it only seems to be supported in Apple's own apps. My guess is that 3rd party apps will have to be updated to support it, unfortunately. I still end up typing in my password a lot.

2) See @conorgriffin's answer for instructions to enable TouchID for sudo

  • 1
    Has anyone actually done this? Looks pretty scary :) – Nic Cottrell Jan 27 '17 at 12:52
  • @NicCottrell yes, working fine on my end – swrobel Jan 27 '17 at 15:58

To allow TouchID on your Mac to authenticate you for sudo access instead of a password you need to do the following.

  • open Terminal
  • switch to the root user with sudo su -
  • edit the /etc/pam.d/sudo file with a command-line editor such as vim or nano
  • The contents of this file should look like this

    # sudo: auth account password session
    auth       required       pam_opendirectory.so
    account    required       pam_permit.so
    password   required       pam_deny.so
    session    required       pam_permit.so
  • you need to add an additional auth line to the top so it now looks like this:

    # sudo: auth account password session
    auth       sufficient     pam_tid.so
    auth       required       pam_opendirectory.so
    account    required       pam_permit.so
    password   required       pam_deny.so
    session    required       pam_permit.so
  • save the file (Note: this file is normally read-only so saving your changes may require you to force the save, e.g. vim will require you to use wq! when saving)
  • exit from the root user or start a new terminal session
  • try to use sudo and you should be prompted to authenticate with TouchID as shown below TouchID prompt
  • if you click 'Cancel' you can just enter your password at the terminal prompt, if you click 'Use Password' you can enter your password in the dialog box.
  • if you SSH into your machine it will fall back to just use your password since you can't send your TouchID fingerprints over SSH
  • 4
    Seems to work! Are there any security implications with this? – Znarkus Dec 11 '17 at 10:07
  • 1
    This should be the accepted answer - It's clear what happens, how it's done, and there is no need to install third party software. – Jeppe Mariager-Lam Jun 20 '18 at 11:19
  • Is there a way to replace all password prompts with TouchID? Whether it's in terminal, or in System Preferences, or in Keychain, or for Package installations? – Max Coplan Sep 20 '18 at 22:02
  • @MaxCoplan probably worth asking as a separate question – conorgriffin Sep 20 '18 at 22:03
  • There are a bunch of other files in /etc/pam.d. What would adding this line to the top of those do? For example, would adding it to /etc/pam.d/su work? What do the other files do? (does this also deserve its own question?) – Max Coplan Sep 20 '18 at 22:22

You can use fingerprint for getting sudo access in the terminal or iTerm, just add auth sufficient pam_tid.so to the first line to your /etc/pam.d/sudo file.


I have created a simple script that enables sudo to use the TouchID PAM module exactly as conorgriffin explains. It does it in a single script that you can copy-paste to a terminal in it's entirety or use the "curl pipe bash" shortcut:

curl -sL https://gist.githubusercontent.com/RichardBronosky/31660eb4b0f0ba5e673b9bc3c9148a70/raw/touchid_sudo.sh | bash

The complete script:


# curl -sL https://gist.githubusercontent.com/RichardBronosky/31660eb4b0f0ba5e673b9bc3c9148a70/raw/touchid_sudo.sh | bash
# This script is ready to copy-paste in whole, or just the line above (without the leading #)

# Use TouchID for sudo on modern MacBook Pro machines
# This script adds a single line to the top of the PAM configuration for sudo
# See: https://apple.stackexchange.com/q/259093/41827 for more info.

  sudo bash -eu <<'EOF'
  # A backup file will be created with the pattern /etc/pam.d/.sudo.1
  # (where 1 is the number of backups, so that rerunning this doesn't make you lose your original)
  bak=$(dirname $file)/.$(basename $file).$(echo $(ls $(dirname $file)/{,.}$(basename $file)* | wc -l))
  cp $file $bak
  awk -v is_done='pam_tid' -v rule='auth       sufficient     pam_tid.so' '
    # $1 is the first field
    # !~ means "does not match pattern"
    if($1 !~ /^#.*/){
    # $0 is the whole line
    if(line_number_not_counting_comments==1 && $0 !~ is_done){
      print rule
  }' > $file < $bak


This script demonstrates a few cool patterns that I love to teach people who are new to bash or DevOps.

  1. Create a backup file that is numbered rather than simply .bak on the end. (It looks gnarly, but that pattern works with whatever is in $file and is reusable.
  2. To make it safe to do curl ... | bash, wrap everything in a function and call it on the last line. That way if the download is interrupted, nothing is (partially) done.
  3. Put a call to sudo bash -eu in your script so that you don't have tell the user to do it. (-eu are short for errexit and nounset and you should be using them!)
  4. Single quoting bash heredoc 'EOF' to prevent premature shell expansion.
  5. Making inline awk more readable.

I created the following ansible tasks to enable touch id for sudo commands if your computer supports it:

- name: detect touch id support
  shell: pgrep ControlStrip
  ignore_errors: true
  register: touch_id_result

- name: enable touch id for sudo commands
    path: /etc/pam.d/sudo
    line: 'auth       sufficient     pam_tid.so'
    insertbefore: '^auth       sufficient     pam_smartcard.so$'
  become: yes
  when: touch_id_result.rc == 0 and touch_id_result.stdout != ''

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.