pam-script parece uma solução. Uma citação da página man:
pam-script allows you to execute scripts during authorization, passwd changes, and on session opening or closing.
Such scripts can perform necessary tasks or influence the outcome of the PAM stack. For example, if the following entry was included in pam.conf
sshd auth required pam_script
then if the script, pam_script_auth, exits with a non-zero value this would cause the user to be denied SSH access to the machine.