I think "turnstile" is a suitable option for this purpose. It's designed in three parts: a PAM module for detecting logins, a Daemon and some service supervisor loader scripts (backends). Currently it does support Dinit and Runit as backends but there should not be any problem around writing a backend for s6-rc. See https://github.com/chimera-linux/turnstile for project itself and more info.Thank you for your suggestion, this looks very promising. I will read into pam and write a local ebuild to install and test turnstile. This ebuild shall then be part of the overlay.
Anyhow, it seems this is the best solution until Bercot comes up with an alternative to PAM and utmp.
Paul
OpenPGP_0x71C7C85A2EA30F62.asc
Description: OpenPGP public key
OpenPGP_signature.asc
Description: OpenPGP digital signature