For all users, or a particular user? For a single user, set it in their
.bashrc file; for all users, check out pam_exec.
If the users are coming in from
sshd, you'll want to add the following line to
/etc/pam.d/sshd; other files depending on their source:
session optional pam_exec.so seteuid /path/to/my/hook.sh
For testing purposes, the module is included as
optional, so that you can still log in if it fails. After you made sure that it works, you can change
required. Then login won't be possible unless the execution of your hook script is successful.
Note: As always when you change the login configuration, leave a backup shell open in the background and test the login from a new terminal.