16.04 - lightdm - 每次登录尝试和每次帐户解锁时运行命令

Question 1

总结：

它可以工作，但是某些包可能会覆盖你的配置，然后你就完蛋了。

我在这里取得了一些进展。我知道该如何运行*每一个*身份验证尝试。

我的 /etc/pam.d/common-auth：

#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.).  The default is to use the
# traditional Unix authentication mechanisms.
#
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.

# here are the per-package modules (the "Primary" block)
auth    [success=2 default=ignore]  pam_unix.so nullok_secure
# here's the fallback if no module succeeds
auth    optional            pam_exec.so quiet /usr/local/bin/onlogin.sh fail
auth    requisite           pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth    optional            pam_exec.so quiet /usr/local/bin/onlogin.sh ok
auth    required            pam_permit.so
# and here are more per-package modules (the "Additional" block)
auth    optional    pam_ecryptfs.so unwrap
# end of pam-auth-update config

那么，让我们从头开始：

auth    [success=2 default=ignore]  pam_unix.so nullok_secure

默认情况下，success 等于 1。它告诉 PAM 如果用户已成功验证，它应该跳过多少行。我已将其更改为 2，因为我添加了以下行：

auth    optional            pam_exec.so quiet /usr/local/bin/onlogin.sh fail

因此，auth当然，告诉 PAM 在每次身份验证时运行命令。然后，optional我猜即使出现错误也应该传递脚本。是一个以作为参数运行脚本pam_exec.so的库，因为当用户输入错误的凭据时会执行此行。我添加了，因为在我的 VM 上每次/身份验证都会出现错误。/usr/local/bin/onlogin.shfailquietsudosu

下一行以结尾pam_deny.so，顾名思义，阻止用户访问。此处为默认设置。

然后，与上面相同的行，但以结尾ok，以告诉脚本用户验证成功。

    auth    optional            pam_exec.so quiet /usr/local/bin/onlogin.sh ok

一切都运行正常，但是…问题是当我尝试登录 Ubuntu 的内置来宾帐户。因为，嗯，没有身份验证。没有密码 = 无需身份验证。在这种情况下，@NGRhodes 提供的解决方案有效。

在我的 Ubuntu xenial VM 上，一切都运行正常，所以我将其移至物理机，重新启动机器，登录我的帐户，然后重新登录到客户机。很好。再次重新启动 - 效果很好。

因此，像往常一样，我每天晚上都会更新我的机器。重启。登录。密码不正确。再试一次 - 密码不正确... 启动一些 livecd 发行版，cd进入/etc/pam.d/以关闭它，我看到了什么？success=2变成了success=1，每次尝试 - 成功或失败 - 都执行了pam_deny.so。

再次启动，成功登录，tailf /var/log/apt/history.log | grep -i pam然后libpam-cgfs出现一些错误。所以，这个包（可能）被覆盖了部分的/etc/pam.d/common-auth。

为后代附加onlogin.sh：） - 记得先安装 fswebcam。

#!/bin/bash

# $PAM_* variables are described in `man pam_exec`

RESULT="${1}"                               # login result (ok/fail)
WEBCAM_DEV="/dev/video0"                        # webcam device
WEBCAM_RES="1280x720"                           # desired screen resolution (if too large fswebcam fallbacks to device's max)
FRAMES="1"                              # how many shots to take (also add nanoseconds to date in filename to prevent overwrite and/or fswebcam crash)

PHOTO_DIR="/opt/_webcam"                        # where to save photos
FILENAME="${RESULT}_${PAM_USER}_$(date +%Y-%m-%d_%H-%M-%S).jpg"     # filename
OUTPUT="${PHOTO_DIR}/${FILENAME}"                   # dir+filename

# create dir
mkdir -p ${PHOTO_DIR}

# append to the log
if [[ ${RESULT} == 'ok' ]]; then
    RESULT='succeed'
else
    RESULT='failed'
fi

logger -t 'onlogin.sh' "Login ${RESULT} by ${PAM_SERVICE} at ${PAM_TTY} for user ${PAM_USER}"

# say cheeeeese (if authorization is provided by lightdm)
if [[ ${PAM_SERVICE} == "lightdm" ]]; then
    fswebcam -d ${WEBCAM_DEV} -r ${WEBCAM_RES} --jpeg 90 -q -F ${FRAMES} ${OUTPUT}
else
    # if authorization is provided by something else (e.g. sudo) do nothing
    :
fi

一些帖子非常有用：

Answer

总结：