I'd like to run a script if the login on my machine fails 3 times (not ssh, but someone in terminal trying to login, or someone trying to physically login). Also, is if it is possible to configure the amount of times before running the script?

I've looked into PAM, and from what I understand, you can only run .so files, and it looks like a huge hassle to set up. Any alternatives?

Another thing I thought about is, maybe Linux runs some script when login fails. If it does, then I could append sh /var/myscript.sh or whatever. Any ideas?

I can't seem to find anywhere on the internet that covers this. If it is possible to run a script every time you have a failed login attempt, I could deal with that.

  • 3
    pam can only run .so files, but one of them is pam_exec.so, which can execute your script. Like: session optional pam_exec.so /var/myscript.sh – Tim Kennedy Jan 23 '17 at 3:13

Alrighty. I figured it out. Be very careful not to mess up, cause you may screw up your system if you do this wrong. If you don't feel comfortable with this, it is probably best to try it in a virtual machine first.


  1. Create your script. In this tutorial, I will place the script in /var/myscript.sh. You can safely replace the script path to wherever your script is. Be sure the script does not, under any circumstances, exit with any code other than 0. Also, add the command exit 0 to the end of the script to be sure it exits correctly. Be sure to test the script before continuing.
  2. Make your script executable with chmod +x /var/myscript.sh
  3. Before the real work happens, in case you do mess up, open Terminal and type sudo -i. Just leave that window open in case.
  4. gksudo nano /etc/pam.d/common-auth. You can replace nano with whatever text editor. To make a backup, you can do sudo cp /etc/pam.d/common-auth /etc/pam.d/common-auth.bkup
  5. Find the line below: auth [success=1 default=ignore] pam_unix.so nullok_secure
  6. On that line, change success=1 to success=2. This is to be sure the script doesn't run if the login was successful.
  7. Add this line directly beneath the line in step 5: auth [default=ignore] pam_exec.so seteuid /var/myscript.sh
  8. Save and close.
  9. Without rebooting or 'relogging', open a new terminal and run su -l <username>.
  10. Intentionally type the wrong password, and check if the script worked. Then, try step 9 again, but with the correct password. Make sure you can login.


Thanks to a lot of documentation and posts, especially this one.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.