For compatibility with Linux PAM's pam_exec module, allow the password to be optionally passed to the executed program's stdin.

Install "pamtester" from pkg/ports.

Create an executable script my_script.sh containing:

#!/bin/sh
read password
if [ "$PAM_USER" == "abc" ] && [ "$password" == "123" ] ; then
  exit 0
else
  exit 1
fi

Create /etc/pam.d/my-service containing:

auth required /path/to/pam_exec.so expose_authtok /path/to/my_script.sh
account required pam_permit.so

Now run:

pamtester my-service abc authenticate

It waits for a password; entering "123" succeeds, anything else fails.