I am trying to use the Pluggable Authentication Module to execute a script when login fails on my Arch Linux system. Arch Linux does not have a common-auth file and I decided not to create one either. Instead I found that the PAM stack uses the system-auth file for some functionalities and I decided to edit it.
The original system-auth file was as follows
#%PAM-1.0
auth required pam_unix.so try_first_pass nullok
auth optional pam_permit.so
auth required pam_env.so
account required pam_unix.so
account optional pam_permit.so
account required pam_time.so
password required pam_unix.so try_first_pass nullok sha512 shadow
password optional pam_permit.so
session required pam_limits.so
session required pam_unix.so
session optional pam_permit.so
To execute the script when login fails, I changed the auth block as follows
auth [success=1 default=ignore] pam_unix.so try_first_pass nullok
auth optional pam_exec.so <path to the script file>
auth optional pam_permit.so
auth required pam_env.so
account required pam_unix.so
account optional pam_permit.so
account required pam_time.so
password required pam_unix.so try_first_pass nullok sha512 shadow
password optional pam_permit.so
session required pam_limits.so
session required pam_unix.so
session optional pam_permit.so
The sudo command is one command that uses this system-auth file in the PAM stack on my system. However when I try to use the sudo command after editing the file as above, the sudo command executes even if I enter the incorrect password.
Would appreciate if someone could tell me what is going wrong here and help me to correct it
default=bad
? Check the equivalent ofrequired
in manpages.ubuntu.com/manpages/trusty/en/man5/pam.d.5.html