pam_touchid appears to break sudo over SSH about pam_touchid

[ITJesse]

if (getenv("SSH_TTY"))
return PAM_IGNORE;

@hamzasood
I can also confirm it works.
Why don't you merge it into code?

[hamzasood]

Interesting, I hadn't thought of that.

Does it work if you add something like:

if (getenv("SSH_TTY"))  
    return PAM_IGNORE;

to the very top of pam_sm_authenticate?

I can't test it at the moment, but hopefully that will make it fallback to the default authentication method when run from ssh (assuming you kept the opendirectory line intact in the ssh pam.d entry)

[caesar]

@AdnanHodzic yes. He also opened a PR (#4) to merge that fix into this project but @hamzasood unfortunately never merged it.

[fraimondo]

Just tested it. I can confirm it works.

[cqexbesd]

I think also that XPC_SERVICE_NAME will be set if running a shell locally - but that might depend on if you are using Terminal.app or an alternative. Neither way seem that great as a proxy for detecting if the user is local or not but I can't think of a better way.

[barry-scott]

@cqexbesd what if I have a GUI app that spawns a sudo command? Will I see the XPC_SERVICE_NAME then?

[caesar]

Looks like this project may be abandoned, sadly... in the meantime, @BenKesselring has a fork with this bug fixed: https://github.com/BenKesselring/pam_touchid/

[AdnanHodzic]

@caesar didn't have a chance to check, did he include if (getenv("SSH_TTY")) return PAM_IGNORE; into his fork/master?