I have created a simple script that enables sudo to use the TouchID PAM module exactly as conorgriffin explains. It does it in a single script that you can copy-paste to a terminal in it's entirety or use the "`curl` pipe `bash`" shortcut:

`curl -sL https://gist.githubusercontent.com/RichardBronosky/31660eb4b0f0ba5e673b9bc3c9148a70/raw/touchid_sudo.sh | bash`

[The complete script][1]:

```sh
#!/usr/bin/env bash 

# curl -sL https://gist.githubusercontent.com/RichardBronosky/31660eb4b0f0ba5e673b9bc3c9148a70/raw/touchid_sudo.sh | bash
# This script is ready to copy-paste in whole, or just the line above (without the leading #)

# Use TouchID for sudo on modern MacBook Pro machines
# This script adds a single line to the top of the PAM configuration for sudo
# See: https://apple.stackexchange.com/q/259093/41827 for more info.

touchid_sudo(){
  sudo bash -eu <<'EOF'
  file=/etc/pam.d/sudo
  # A backup file will be created with the pattern /etc/pam.d/.sudo.1
  # (where 1 is the number of backups, so that rerunning this doesn't make you lose your original)
  file_dir="$(dirname "$file")"
  file_name="$(basename "$file")"
  mapfile -t backup_list < <( ls -A "$file_dir"/{,.}"$file_name"* 2>/dev/null )
  backup_count="${#backup_list[@]}"
  backup_ext="$backup_count"
  backup="$file_dir/.$file_name.$backup_ext"
  cp "$file" "$backup" 2>/dev/null || touch "$file" "$backup"

  awk -v is_done='pam_tid' -v rule='auth       sufficient     pam_tid.so' '
  {
    # $1 is the first field
    # !~ means "does not match pattern"
    if($1 !~ /^#.*/){
      line_number_not_counting_comments++
    }
    # $0 is the whole line
    if(line_number_not_counting_comments==1 && $0 !~ is_done){
      print rule
    }
    print
  }' > $file < $backup
EOF
}

touchid_sudo
```

This script demonstrates a few cool patterns that I love to teach people who are new to bash or DevOps.

1. Create a backup file that is numbered rather than simply `.bak` on the end. (It looks gnarly, but that pattern works with whatever is in `$file` and is reusable.
1. To make it safe to do `curl ... | bash`, wrap everything in a function and call it on the last line. That way if the download is interrupted, nothing is (partially) done.
1. Put a call to `sudo bash -eu` in your script so that you don't have tell the user to do it. (`-eu` are short for [errexit and nounset][2] and you should be using them!)
1. Single quoting bash heredoc `'EOF'` to prevent premature shell expansion.
1. Making inline `awk` more readable.


  [1]: https://gist.github.com/RichardBronosky/31660eb4b0f0ba5e673b9bc3c9148a70
  [2]: https://www.google.com/search?q=bash%20errexit%20nounset