You might be interested in
pam_exec. I use it to open extra ports to addresses that have successfully authenticated to
account optional pam_exec.so /usr/local/bin/update-whitelist
update-whitelist script looks like
# Called from PAM when logging in via SSH.
# Adds current client to SSH whitelist.
test -n "$PAM_RHOST"
test -f "$WHITELIST"
# Handle PAM_RHOST as hostname or IPv4 dotted-quad
if echo "$PAM_RHOST" | /bin/grep -P -q '^\d+\.\d+\.\d+\.\d+$'
then echo "+$PAM_RHOST" >"$WHITELIST"
else /usr/bin/host "$PAM_RHOST" | /bin/sed -n -e 's/.* has address /+/p' >"$WHITELIST"
iptables rules that use
Also of interest may be
libpam-script, which can run an arbitrary command as part of authentication or session start:
$ aptitude show libpam-script
Description: PAM module which allows executing a script
This module will allow you to execute scripts during authorization, password
changes and sessions. This is very handy if your current security application
has no PAM support but is accessible with perl or other scripts.
I haven't actually used this, but it may be worth investigation.