restricting login on dialup connections

Hi,

what I really want is a second password on some ttys but it seems pam cannot
do this.

Alternatively, how can I tell pam to only admit some special login names on
selected ttys?

Maybe using the pam_listfile module but I don't see how I can define
something like "admit if (tty<>modem) or (user=modemuser)"
or "deny if (tty=modem) and (user<>modemuser)"

Wolfgang