I'm considering using yubikey (5 NFC model) as second factor for couple of Linux hosts. I'm interested in sticking it somewhere in PAM stack, so things like
sudo are protected. Most of those hosts are only remote, that is I can't plug they key in the remote host. I have following options:
yubico-pamwith their YubicoCloud verifying every code the key provides. Simple enough to set up and convenient to use (touch to auth) but completely useless for a host that can't talk to Yubico's servers (eg. in a private network without Internet access) and a potential problem for server that loses its network connectivity (eg. crappy uplink).
pam_oathwith HOTP-OATH configured in one of the key's slots. This does away with the dependency on the third party and maintains convince of "touch to auth". On a flip side, there's only room for one secret, so every host would have to use it - if a host is compromised, you need to reissue the secret on all hosts
pam_oathwith yubikey's OATH application. Can have multiple secrets (32?), with the downside that I now need to run
ykman oath code ...in order to get the code. This won't work if the client is a Chromebook for example. Plus you need to copy&paste the code.
yubico-pam but from what I understand, the key needs to be plugged in directly into the host where this pam stack is running in order to receive the challenge.
Is there any other method that I have missed? Have I missed anything in terms of upsides/downsides and limitations? With just a handful of hosts I'm partial to the second method, but I wonder what are people using for large deployments and large number of hosts?