I use a Yubikey to log in to a VPN. When logging in, I supply a username, and then type a password, and without hitting return, touch the Yubikey.
As far as I understand, and from experimenting, the Yubikey looks like a keyboard to the OS, and it appends a one-time, encrypted, string, finishing with an EOL. This is explained in this question
However, I understood that good authentication works by sending a hash of the user's password to the remote server, and this works if I'm sending just a OTP. if If the user password+Yubikey OTP string is hashed on the client, how is it disentangled to be verified on the server? Is my password stored un-hashed on the server?