Change to pam.d config file overwritten everytime macOS is updated

[tthoma24]

Everytime I updated macOS, the line I added to /etc/pam.d/sudo to enable pam_watchid gets removed.

[pesqair]

i guess we have to add it back in every time?

[jspiro]

https://gist.github.com/jspiro/0c9f15b0806aca17b092ef26713adcfe

I run this after updates to re-add TouchID support. I stopped bothering with the watchid support since I got a new computer. You could update the file to support watchid.

[tthoma24]

This doesn't explain why the file is overwritten every time the OS is updated. /etc isn't a protected directory, and I can't see any special attributes set on the folder that indicate anything special about it.

[tthoma24]

I opened a case with Apple Support, and Engineering and DevSupport are going to get back to me on this

[sdondley]

Hear anything back?

[rockkoca]

Not just this. Any changes to the ulimit and ssh configuration also got reset after each update.

This is a "feature" of macos! 😔️

[obra]

https://developer.apple.com/forums/thread/14637?answerId=44637022#44637022
Previous reports are that blowing away local pam changes is considered a feature.

[henrik242]

Any changes to the ulimit and ssh configuration also got reset after each update.

That's such an awful feature, since it re-enables SSH password authentication on my home server on every update 😠