screenguard

Screenshots

PAM-level captureHooks the failure path of /etc/pam.d/common-auth. Failed logins fire a capture; successful ones never trigger anything.
Pick any camerasAt configure time, scans /dev/video* and lets you pick one, several, or all of them.
Your own Telegram botYou create the bot with @BotFather. The token stays on your machine, root-owned, 0600.
Rich contextEvery alert carries timestamp (IST), hostname, Wi-Fi SSID, IP, and the PAM service / user / TTY that triggered it.
Offline-safeBundles are retained on disk if Telegram is unreachable; screenguard flush retries later.
Reversible installBacks up common-auth before patching. screenguard uninstall restores it cleanly.

Make a Telegram bot.

DM @BotFather, run /newbot, copy the HTTP API token.

Clone and install.

git clone https://github.com/legitcoconut/screenguard.git
cd screenguard
sudo ./install.sh

Configure.
```
sudo screenguard configure
```
Paste the bot token, message your bot once so it can auto-detect your chat ID, then pick the cameras to use.
Test.
```
sudo screenguard test
```
Captures from every selected camera and posts a test message. If it lands, the PAM hook will too.