Zola 2026-06-12T00:00:00+00:00 https://thde.io/tags/macos/atom.xml 2026-06-12T00:00:00+00:00 2026-06-12T00:00:00+00:00 Unknown https://thde.io/blog/secure-enclave-ssh/ <p><a rel="external" href="https://github.com/maxgoedjen/secretive">Secretive</a> has been the go-to app for storing SSH keys in the Secure Enclave — keeping private key material inside the chip, protected by Touch ID, never exposed to the OS. macOS 26 makes it unnecessary: the same protection is now built in via <code>sc_auth</code> and <code>/usr/lib/ssh-keychain.dylib</code>.</p> <p>See <a rel="external" href="https://algustionesa.com/native-secure-enclave-ssh-keys-the-macos-guide/">Native Secure Enclave SSH Keys — the macOS guide</a> for the full setup, or the <a rel="external" href="https://gist.github.com/arianvp/5f59f1783e3eaf1a2d4cd8e952bb4acf">quick gist</a> for the short version. Apple’s documentation on <a rel="external" href="https://developer.apple.com/documentation/security/protecting-keys-with-the-secure-enclave">Protecting keys with the Secure Enclave</a> covers the underlying API.</p> 2026-06-07T00:00:00+00:00 2026-06-07T00:00:00+00:00 Unknown https://thde.io/blog/touchid-sudo/ <p>Since macOS Sonoma, there is an official way to enable Touch ID for <code>sudo</code> that survives OS updates via <code>/etc/pam.d/sudo_local</code>.<sup class="footnote-reference" id="fr-1-1"><a href="#fn-1">1</a></sup></p> <p>Run this single command to apply it:</p> <pre class="giallo" style="color-scheme: light dark; color: light-dark(#657B83, #839496); background-color: light-dark(#FDF6E3, #002B36);"><code data-lang="shellscript"><span class="giallo-l"><span style="color: light-dark(#268BD2, #268BD2);">sed</span><span style="color: light-dark(#2AA198, #2AA198);"> &quot;</span><span style="color: light-dark(#2AA198, #2AA198);">s/^#auth/auth/</span><span style="color: light-dark(#2AA198, #2AA198);">&quot;</span><span style="color: light-dark(#2AA198, #2AA198);"> /etc/pam.d/sudo_local.template</span><span style="color: light-dark(#859900, #859900);"> |</span><span style="color: light-dark(#268BD2, #268BD2);"> sudo</span><span style="color: light-dark(#2AA198, #2AA198);"> tee</span><span style="color: light-dark(#2AA198, #2AA198);"> /etc/pam.d/sudo_local</span></span></code></pre> <p>This copies the system-provided template and uncomments the <code>pam_tid.so</code> line in one step. The resulting file looks like:</p> <pre class="giallo" style="color-scheme: light dark; color: light-dark(#657B83, #839496); background-color: light-dark(#FDF6E3, #002B36);"><code data-lang="plain"><span class="giallo-l"><span># sudo_local: local config file which survives system update and is included for sudo</span></span> <span class="giallo-l"><span># uncomment following line to enable Touch ID for sudo</span></span> <span class="giallo-l"><span>auth sufficient pam_tid.so</span></span></code></pre> <p>Open a new terminal and <code>sudo</code> will prompt for Touch ID.</p> <img src="touchid-sudo.png" alt="Touch ID sudo prompt" width="320"> <section class="footnotes"> <ol class="footnotes-list"> <li id="fn-1"> <p><a rel="external" href="https://support.apple.com/kb/HT213893">Apple Support HT213893</a>, <a rel="external" href="https://apple.stackexchange.com/a/466029">Stack Exchange</a> <a href="#fr-1-1">↩</a></p> </li> </ol> </section>