Automic Vault 3.16.0 · macOS

sudo hardener

The changes, security properties, caveats, and verification path for the sudo hardener.

Run av harden sudo to apply this hardener and av doctor sudo to verify it.

What It Does

av harden sudo previews the PAM change, then directs you to rerun it with sudo. The privileged run appends:

echo 'auth sufficient pam_tid.so' >> /etc/pam.d/sudo_local

macOS must include /etc/pam.d/sudo_local from /etc/pam.d/sudo.
Touch ID sudo still falls back to password authentication when biometrics are unavailable.