Custom login block that redirects to password protected page that is not published otherwise
Giving users permission to view unpublished content could potentially be a security risk, and it's not (easily) possible to restrict it to just viewing a particular content type.

Why not publish the node, but only allow users with a certain role be able to view them using the Content Access module.

Then create a few accounts with this role, setting the usernames and passwords yourself.

Then just use the standard Drupal login form but then alter the redirect once logged in with hook_user_login:

function hook_user_login(&amp;$edit, $account) {
    if (in_array('your_role', $account-&gt;roles)) {
        $edit['redirect'] = 'node/123';
    }
}


By creating the accounts this way it means you can use the main Drupal authentication system so reducing the amount of work that you need to do...