I did not really like the idea of installing some third-party sudo tool, so instead of using sudo-touchid I decided to use the /etc/pam.d/sudo trick and it works wonders. I use iTerm2 with zsh, and with that setup it works correctly. But when I use tmux (with reattach-to-user-namespace default command) sudo always asks for a password. Does anyone know how to solve this?

  • What is /etc/pam.d/sudo trick ? – Alex Jul 24 at 16:50
  • Adding auth sufficient pam_tid.so to the top of /etc/pam.d/sudo. – RomaValcer Jul 24 at 17:53
  • @Alex apple.stackexchange.com/a/306324/263848 – JBis Jul 25 at 16:36
  • @JBis Thank you for the link, actually I know this "trick", I just tried to give a clue to OP to update his question to avoid been downvoted for low quality question and use more descriptive steps instead of using word "tricks" which is kinda punishable on this site. – Alex Jul 25 at 20:59
  • 1
    @Alex Ah. Maybe it'll help someone else. – JBis Jul 25 at 21:00
up vote 2 down vote accepted

I experienced the same issues. Surprisingly, Touch ID does work in Apple's GNU screen distribution and after looking at its implementation, it seems like screen attaches to the user's per-session namespace instead of the per-user namespace.

The following patches port this approach to tmux and reattach-to-user-namespace and fix the issue for me:

  1. https://github.com/ChrisJohnsen/tmux-MacOSX-pasteboard/pull/70
  2. https://github.com/tmux/tmux/pull/1434

EDIT: Since these patches caused some technical issues (as explained in the pull request), I instead solved the problem using a custom PAM module to reattach to the user's per-session namespace before running the pam_tid module: https://github.com/fabianishere/pam_reattach

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.