DEV Community

Vagebond
Vagebond

Posted on

Touch ID for sudo over ssh. Without a PAM module.

#linux #security #tutorial

On your Mac, sudo can ask for Touch ID. Over ssh, it cannot. This post walks through the gap, the usual fix and another way.

Touch ID for sudo, locally

Since macOS 14, one line in one file is enough. The file survives system updates.

sudo cp /etc/pam.d/sudo_local.template /etc/pam.d/sudo_local
sudo nano /etc/pam.d/sudo_local
Enter fullscreen mode Exit fullscreen mode

Uncomment this line:

auth       sufficient     pam_tid.so
Enter fullscreen mode Exit fullscreen mode

Now sudo in Terminal asks for your fingerprint.

Why it stops at ssh

pam_tid.so runs on your Mac. When you run sudo on a server, PAM runs on the server. The server has no Touch ID sensor. So it asks for a password.

The usual fix: a PAM module on every server

The common route is an ssh key that needs Touch ID, plus pam_ssh_agent_auth on the server. sudo then checks your forwarded agent instead of a password.

On each server, install the module:

sudo apt install libpam-ssh-agent-auth
Enter fullscreen mode Exit fullscreen mode

In /etc/pam.d/sudo, above the other auth lines:

auth sufficient pam_ssh_agent_auth.so file=/etc/security/authorized_keys
Enter fullscreen mode Exit fullscreen mode

In sudoers, through sudo visudo:

Defaults env_keep += "SSH_AUTH_SOCK"
Enter fullscreen mode Exit fullscreen mode

Then connect with agent forwarding:

ssh -A you@server
Enter fullscreen mode Exit fullscreen mode

This works. It also means a PAM change on every server. The list of keys has to stay in sync. And the server can use your agent socket for as long as you are connected.

Another way: type the password

Kluis is a password vault for the Mac, for the terminal and the desktop. The kluis command types sudo passwords over ssh.

The server keeps its normal sudo and its normal password. You install nothing there.

The password is not on the screen, not in the shell history, not in a file. Every read of a secret asks for Touch ID. Keys are kept in the Secure Enclave and never leave the Mac.

A few things help with many servers:

  • Timed sessions after one Touch ID.
  • Rotate a sudo password on the server from the vault.
  • An audit log of reads.

What Kluis is not

Kluis does not put Touch ID on the server. The server still asks for a password. Kluis types it for you.

If you want sudo without any password, backed by a key, the PAM route is the right one.

Try it

Kluis is free. It needs macOS 14 or later on Apple silicon. No account, no server.

Download the disk image, drag Kluis to Applications and open it. The site links to the docs for the kluis commands.

Kluis is here:

https://baken.vagebond.nl/r/ryHBvrA9

Top comments (0)