An addition to… Take iSight snapshots during invalid login attempts
Check out this post on Mac OS X hints.com: Take iSight snapshots during invalid login attempts.
It is a pretty cool setup, if someone enters the wrong password on your laptop, picture is taken and stored. That’s neat, but I’m pretty sure I’m not going to check the /var/logs/authfail folder so I wrote a quick script that looks to see if there is an item in the folder and displays it in Preview. Add the script to your login items and your all set!
Download the script:Login Attempt picture viewer
To use it, open System Preferences, click on Accounts, choose your accounts and drag drop the script into the login items.
December 12th, 2006 at Dec 12, 06 | 8:56 pm
you are the man dogg
December 12th, 2006 at Dec 12, 06 | 9:05 pm
Thanks very much:) worked as described.
December 12th, 2006 at Dec 12, 06 | 9:14 pm
hey now how do you clear the history i’m still getting tons of pics from previous attempts now i want to delete have see whats current.
December 12th, 2006 at Dec 12, 06 | 9:16 pm
If you command click on the title of the document in Preview, it will present a drop down menu showing what folder it is in. Click on the folder the image sits in, it will open the folder in Finder. Select the files, drag to trash, it’ll ask you for your password.
I figure that’s easy enough, as I bet I won’t have more than 1 login attempt a month.
December 12th, 2006 at Dec 12, 06 | 9:34 pm
Is there any way to change the target folder from authfail to the desktop?
December 12th, 2006 at Dec 12, 06 | 9:37 pm
Lucas: I did not write the original script on macosxhints.com. I took at look at it and it appeared you could just change the perl script to where it dumps the pictures (such as your desktop,) but I was worried about if the script would have permissions… so instead I threw this together.
December 12th, 2006 at Dec 12, 06 | 11:03 pm
Nice one. If you remove step 2, Preview will open all the images in one window, just as if you ran ‘open -a Preview /var/log/authfail’.
December 12th, 2006 at Dec 12, 06 | 11:09 pm
Thanks for the comment grant. I had originally tried that setup, but that results in Preview opening even if their are no photos. I wanted this to be the least intrusive.
December 12th, 2006 at Dec 12, 06 | 11:10 pm
You could always create a cron job to move the files from the authfail folder to your desktop every minute.
Using terminal, enter the following commands:
1. crontab -e (a vi editor window will open)
2. * * * * * /home/Users/username/moveMe
3. SHIFT + zz (the changes will be saved and the vi editor window will close)
4. vim moveMe (a vi editor window will open)
5. mv /var/log/authfail/* /Users/jim/Desktop/.
6. SHIFT + zz (the changes will be saved and the vi editor window will close)
7. chmod +x moveMe
8.sudo chmod 777 /var/log/authfail/
Every time a picture is added to the authfail folder, it will be moved to your desktop. If you don’t keep a cluttered desktop, it should be obvious that someone tried to hack into your system as soon as you log into your account and of course it will be easy to delete the pictures!
December 12th, 2006 at Dec 12, 06 | 11:15 pm
doh!
Replace ‘username’ and ‘jim’ from my last response with your username.
December 13th, 2006 at Dec 13, 06 | 7:09 am
This app is nice. However, how would I make it run whenever I login from a screensaver? I added it to my login items as described in the post, and currently it only works when I login to the machine (as it should). Is there a way to make this work when I login from screensaver/resume the computer from sleeping? I rarely, if ever, shutdown my MBP or logout, since I’m a student and often moving about. Currently I’ve got folder actions enabled on /private/var/logs/authfail to run the show new items action, which does work to open /var/log/authfail, but doesn’t automatically open the images. I’m not sure how to open the images using applescript or otherwise.
December 13th, 2006 at Dec 13, 06 | 10:25 am
I found a pretty good solution using folder actions.
1. enable folder actions (right-click on a folder in Finder)
2. make an Automator workflow with only one action: Open Images in Preview
3. File → Save As Plug-in…
4. give it a name
5. change ‘Plug-in for’ to ‘Folder Actions’
6. choose ‘Other…’ for ‘Attached to Folder’
7. hit ⌃⇧G and type ‘/var/log/authfail’
8. click Save
Seems to work properly, and it only opens new images.
December 13th, 2006 at Dec 13, 06 | 10:32 am
William, I think Grant answered your question. That looks great. I love all the cool ways to automate stuff on the mac.
December 14th, 2006 at Dec 14, 06 | 12:42 am
This is awesome! Thanks for the tip, grant. Now, can someone make a full package for all of this so that a newb like me (although I eventually figured it out) would only have to hit Install and have this all done automatically for him/her? A quick suggestion: could there be leading zeroes for the date/time if one is only one digit long? And could it sort by decreasing unit of time? I’d rather have the formula “[username] [year] [month] [day] [hour] [minute ][second]” so that I could sort by filename and still be sorted by date. What do you think?
December 14th, 2006 at Dec 14, 06 | 8:14 am
Each time I learn something new on OS X, I love the OS more and more, especially with aspect to the automation. Hell, now I know how to make folder actions easily. Doing what grant posted works great, but I wanted a little more. I took the script that Automator exported and added to it from the show new items action. Here is the action I’ve got running on /var/log/authfail
on adding folder items to this_folder after receiving added_items
tell application “Finder”
activate
open this_folder
reveal the added_items
end tell
tell application “wgibb:Library:Workflows:Applications:Folder Actions:imageopen.app”
open added_items
end tell
end adding folder items to
December 14th, 2006 at Dec 14, 06 | 7:11 pm
[...] Automator Script for Image Viewing [...]
January 4th, 2007 at Jan 04, 07 | 10:17 pm
Thanks to you for giving the very needed informations to one and all…really you are genius !
Don Lapre Lenny
webmaster@donlapresite.com
http://www.donlapresite.com
April 9th, 2007 at Apr 09, 07 | 5:56 pm
Hi..How do u delete the older pics that the isight has taken…I try to delete them but they come back like a boomerang. Thanks Ken
April 25th, 2007 at Apr 25, 07 | 3:09 pm
This is perfect! Very nice job, well designed, well explained. Well done! Works PERFECT! Thumbs up