Linux custom authentication?

Question

linux

Is it possible to somehow make a custom additional check when a user logs in to the ubuntu server? A little more information:
I want to send ubuntu to my device AFTER successfully entering the password and login when authorizing on the server (I plan to do it, I use the ESP8266 module, which allows you to work via Wi-Fi) and then do some actions on the device (it doesn’t matter) and confirm authorization. This is a type of two-factor turns out .. and in fact, until the second factor is confirmed, the user will not receive any opportunities on the server to do something.
Here is some such scheme. I wonder how you can do this on ubuntu.

Answer 1

Use the pam_exec module to call the script.

Answer 2

Through PAM, of course. After pam_unix is ​​triggered, install your pam_mycoolmodule module that does the actions, set required if it is interesting that the next modules in the chain work (but there will still be a failure) or requisite if you want the failure to return immediately in case of an error.
It is better to write the module yourself, and not through pam_exec, especially if it will work with passwords.