How to correctly use PAM to execute a script upon login failure

Question

I am trying to use the Pluggable Authentication Module to execute a script when login fails on my Arch Linux system. Arch Linux does not have a common-auth file and I decided not to create one either. Instead I found that the PAM stack uses the system-auth file for some functionalities and I decided to edit it.

The original system-auth file was as follows

#%PAM-1.0

auth      required  pam_unix.so     try_first_pass nullok
auth      optional  pam_permit.so
auth      required  pam_env.so

account   required  pam_unix.so
account   optional  pam_permit.so
account   required  pam_time.so

password  required  pam_unix.so     try_first_pass nullok sha512 shadow
password  optional  pam_permit.so

session   required  pam_limits.so
session   required  pam_unix.so
session   optional  pam_permit.so

To execute the script when login fails, I changed the auth block as follows

auth      [success=1 default=ignore]  pam_unix.so     try_first_pass nullok
auth      optional  pam_exec.so <path to the script file>
auth      optional  pam_permit.so
auth      required  pam_env.so

account   required  pam_unix.so
account   optional  pam_permit.so
account   required  pam_time.so

password  required  pam_unix.so     try_first_pass nullok sha512 shadow
password  optional  pam_permit.so

session   required  pam_limits.so
session   required  pam_unix.so
session   optional  pam_permit.so

The sudo command is one command that uses this system-auth file in the PAM stack on my system. However when I try to use the sudo command after editing the file as above, the sudo command executes even if I enter the incorrect password.

Would appreciate if someone could tell me what is going wrong here and help me to correct it

Answer 1

From man pam.d, the description of required:

required
   [success=ok new_authtok_reqd=ok ignore=ignore default=bad]

With default=ignore, the failure from pam_unix is no longer leads to failing of authentication, since your script, and then pam_permit.so will be used and pam_permit.so always succeeds. pam_unix should still have default=bad:

bad
   this action indicates that the return code should be thought of as
   indicative of the module failing. If this module is the first in
   the stack to fail, its status value will be used for that of the
   whole stack.