Laptop Lock Screen Sentry

This is a lightweight, user-space security monitoring system for Linux (GNOME) that detects failed lock screen password attempts, captures photographic evidence via webcam, and immediately alerts the owner via Gotify, a self-hosted push notification server.

Technical description

A systemd user service starts on GNOME login and runs a journal watcher that tails system logs for failed lockscreen password attempts (PAM gdm-password auth failures). When detected, it spawns a capture script which uses ffmpeg to snap a single JPEG from the webcam, saves it locally with a timestamped filename, and pushes a high-priority Gotify notification containing the image embedded inline as a Markdown base64 data URI, all within seconds of the failed login.

This system was created with my OpenCode AI agent.

---

Setup

Prerequisites

Add the user to systemd-journal group:

sudo usermod -a -G systemd-journal $USER

Restart the user session to apply the changes.

---

Setup the scripts

Download the scripts from https://github.com/n-anselm/Laptop-Lock-Screen-Sentry.

Update the configuration variables in failed-login-capture.sh.

Move the scripts to their respective directories:

mv failed-login-watcher.sh failed-login-capture.sh ~/.local/bin/

mkdir -p ~/.config/systemd/user && mv failed-login-watcher.service ~/.config/systemd/user/

Set permissions:

chmod 700 ~/.local/bin/failed-login-capture.sh

chmod 755 ~/.local/bin/failed-login-watcher.sh

---

Enable and start

systemctl --user daemon-reload

systemctl --user enable failed-login-watcher.service

systemctl --user start failed-login-watcher.service

Verify that the systemd service is running:

systemctl --user status failed-login-watcher.service