I am considering purchasing Yubikey devices (made by Yubico) to add two-factor authentication when my users ssh to our various servers. I figured I would configure the device to use Yubico OTP with YubiCloud (via the yubico-pam PAM module).
What are the privacy implications of doing this? Will Yubico know which users are logging into which servers and when? The OTP value includes a static identifier and the server would query YubiCloud the instant the user hits the button, so it seems like Yubico could track users as they log into various servers.
Is there anything I can do to minimize any privacy leaks? For example, can I configure my ssh servers to first try a local validation server and fall back to YubiCloud if the local validation server is unavailable? (I would want to set up some form of synchronization with YubiCloud to prevent OTP replay attacks, but I don't know if that's possible and the synchronization might negate the privacy gains from running my own validation server.)