If you want to capture a snapshot of anyone who unsuccessfully tries to login to your laptop or desktop with a webcam, you can implement a script to capture a snapshot from a webcam on failed login attempts.

To do this properly, hook it into PAM.  PAM already processes the failed login attempt by reporting it in the log.

This is the best method I found to do this:

  1. Edit the /etc/pam.d/common-auth file and insert this line immediately before the line with pam_deny.so module,
    auth [default=ignore] pam_exec.so seteuid /usr/bin/snapshot.sh
  2. Edit the two lines above (pam_unix and pam_winbind) and change the success=2 to success=3 and likewise success=1 to success=2. This will make it skip an extra line when auth is successful. So it skips our script.

  3. Make a script /usr/bin/grab to do what you want when login fails.
snapshot.sh code:
ts=`date +%s`
ffmpeg -f video4linux2 -s vga -i /dev/video0 -vframes 3 /tmp/vid-$ts.%01d.jpg
exit 0

Note: The script must return 0. Of course, you can modify the command executed to anything you want.