Enable Touch ID for sudo on macOS

• System: macOS Sequoia 15.5

Enable Touch ID for sudo

Since macOS Sonoma 14.0, it is allowed to use Touch ID for sudo with a configuration that persists across software updates using /etc/pam.d/sudo_local.

Update /etc/pam.d/sudo_local

# Enable Touch ID for sudo.
auth  sufficient  pam_tid.so

Enable Touch ID for sudo over tmux, screen or other terminal multiplexers

But macOS’s Touch ID PAM module (pam_tid.so) requires access to the user session context associated with a physical GUI login, which can be lost when using multiplexers. We also need pam_reattach.so to rebinds the PAM process to the correct macOS session.

Install pam-reattach

brew install pam-reattach

Update /etc/pam.d/sudo_local

Make sure you check the location of pam_reattach.so installed. When it is not installed in /usr/lib/pam or /usr/local/lib/pam (e.g., on M1 Macs where Homebrew is installed in /opt/homebrew), you must specify the full path to the module in the PAM service file as shown below:

# Enable Touch ID for sudo over tmux / screen.
auth  optional    /opt/homebrew/lib/pam/pam_reattach.so