Need help with pam_exec.so

[nvoqhdok]

Hello. System is Debian 11.

Task - execute custom command after 3 failed login attempts(wrong password) from any username and any environment/utils(ssh, lightdm, su, tty).

Presented modules:

Code: Select all

ls  /etc/pam.d/

chfn                           cups               polkit-1
chpasswd                       lightdm            ppp
chsh                           lightdm-autologin  runuser
common-account                 lightdm-greeter    runuser-l
common-auth                    login              su
common-password                mate-screensaver   sudo
common-session                 newusers           su-l
common-session-noninteractive  other
cron                           passwd

I am struggling to understand which module should be used for custom line with pam_exec.so.
How that line should looks like?

All I could dig so far is - auth optional pam_exec.so seteuid /usr/local/bin/script.sh, but that doesn't work.

Thanks in advance.