Got the idea that I wanted to take some pictures if there’s a failed login attempt on my laptop. A quick google search and this is the way to do it:

Start off by creating a script that will use ffmpeg to takes a pictures using the webcam. I stored it in /usr/local/bin/failed-login.sh:

#!/usr/bin/env bash

DIR="${HOME}/Pictures/Failed Login"
FILE="failed-${HOSTNAME}-$(date +%Y%m%d-%H%M%S).jpg"

ffmpeg -loglevel panic \
    -f video4linux2 \
    -s vga \
    -i /dev/video0 \
    -vframes 1 \
    "${DIR}/${FILE}" >/dev/null

exit 0

In my actual case, I’m storing the pictures on my google drive.

If you have an webserver, it’s a nice feature to make the script upload the pictures there. This however will only work if you make sure that your most used wireless connections are marked with `All users may connect to this network` so you have internet access from the login screen. Also you need to have public key authentication setup for the user you’re going to use. The line below can then be added after the ffmpeg call:

{ scp -i /home/user/.ssh/id_rsa "${DIR}/$[FILE}" user@www.example.com:/var/www/pictures && rm "${DIR}/${FILE}"; } || true

Don’t forget to make it executable with chmod +x /usr/local/bin/failed-login.sh.

Run it manually and make sure that the pictures are stored in ${DIR}.

Last thing is just to modify /etc/pam.d/common-auth to run the script when there’s a failed login attempt. We’d want to change the following line:

auth   [success=1 default=ignore]      pam_unix.so nullok_secure

To:

auth   [success=2 default=ignore]      pam_unix.so nullok_secure

I.e. success=1 to success=2, this is to make sure that the script isn’t executed for a successful login.

After this line add the following:

auth    [default=ignore]                pam_exec.so seteuid /usr/local/bin/failed-login.sh

All in all, the file should look like this (without comments):

auth    [success=2 default=ignore]     pam_unix.so nullok_secure
auth    [default=ignore]                pam_exec.so seteuid /usr/local/bin/failed-login.sh
auth    requisite                       pam_deny.so
auth    required                        pam_permit.so
auth    optional                        pam_cap.so 

Logout and enjoy the new feature of getting pictures of the offenders!

Pretty much everything is taken from this answer on askubuntu.com.