18

I made a mistake in terminal, and now every time I use sudo, I get the error message: sudo: unable to initialize PAM: Invalid argument

I know what I messed up, which is adding a character outside of a comment in the following file: /etc/pam.d/sudo

The contents is as follows:

x# sudo: auth account password session
auth       sufficient     pam_tid.so
auth       sufficient     pam_smartcard.so
auth       required       pam_opendirectory.so
account    required       pam_permit.so
password   required       pam_deny.so
session    required       pam_permit.so

What happened was that I was using nano to edit this file to add pam_tid.so to this file so I can use touch id to bypass sudo. I then pressed Ctr+x to exit out, but missed the Ctr and didn't see the x outside of the comment. So when I try to use sudo, I get the error. The worst part is that to edit this file, I need sudo. Any help would be very much appreciated.

Thanks

2 Answers 2

36

You'll need to find an alternate means of elevating privileges, which is intentionally hard "because security." :) Since this is a Mac, one way is to reboot and hold down command+R to get into the rescue shell, and then start a terminal (it's in the utilities menu, IIRC) where you will have a root shell which can edit the pam file.

Another possible way is to copy the pam file to your home directory, correct it, then copy the file using the Finder (open /etc by selecting "go", then "go to folder" in the finder menu). I'm pretty sure that doesn't use the sudoers pam file to control access, but I don't recall for sure. You may also need to repair permissions after copying this way.

Either way: today's valuable sysadmin lesson is that, when editing pam files, you should always leave the editor window open until you've tested your changes. Save the file without exiting, and in another window (or from another machine, as the case may be), verify that things work. Only then do you exit the editor. :)

9
  • 13
    The Finder option worked wonderfully! Instead of sudo, Finder asked me for a password and sudo is now working. Lesson learned, thank you very much!
    – Arnav
    Oct 19, 2018 at 20:07
  • 4
    The Finder option was unsuccessful for me on macOS Catalina. I had to enter recovery mode (Hold ⌘+R while rebooting), use the Disk Utilitiy to mount the Macintosh HD, then open terminal from the Utilities menu and vim /System/Macintosh\ HD/etc/pam.d/sudo in order to fix it.
    – novwhisky
    Aug 4, 2020 at 1:38
  • 2
    Thanks, you saved my laptop. Oct 26, 2020 at 2:47
  • For BigSur on Apple Silicon I needed to restore MacOS to get my sudo file back in a parsable state.
    – KevM
    Mar 1, 2021 at 17:41
  • 1
    +1 For the Finder way. Could not believe it was going to work, but it did like a charm. Feb 21, 2022 at 8:29
1

Another alternative is to enable Root user ( https://support.apple.com/en-us/HT204012 ) and login with it. Then you will be able to edit the file from finder.

1
  • This saved me pheww
    – SwiftMango
    Aug 1, 2023 at 1:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .