Two offline alternatives come immediately to mind. 1. Reconfigure pam_yubico to use local challenge-response auth instead of YubiCloud. The ykpamcfg(1) man pag

Two offline alternatives come immediately to mind. 1. Reconfigure pam_yubico to use local challenge-response auth instead of YubiCloud. The ykpamcfg(1) man page[1] explains how to do so. 2. Use pam_u2f to enable FIDO2/U2F auth. See, e.g., https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F https://support.yubico.com/hc/en-us/articles/360016649099-Ub... https://docs.fedoraproject.org/en-US/quick-docs/using-yubikeys/#_using_a_yubikey_to_authenticate_to_a_machine_running_fedora https://docs.fedoraproject.org/en-US/quick-docs/using-yubike... Though on Fedora (and RHEL), I personally prefer authselect to hand-editing /etc/pam.d; in particular, authselect's "sssd" default profile includes optional U2F support: $ authselect show sssd | fgrep -C 2 u2f | sed -ne '/u2f/,$p' with-pam-u2f:: Enable authentication via u2f dongle through *pam_u2f*. with-pam-u2f-2fa:: Enable 2nd factor authentication via u2f dongle through *pam_u2f*. without-pam-u2f-nouserok:: Module argument nouserok is omitted if also with-pam-u2f-2fa is used. *WARNING*: Omitting nouserok argument means that users without pam-u2f authentication configured will not be able to log in *INCLUDING* root. Make sure you are able to log in before losing root privileges. [1] https://raw.githubusercontent.com/Yubico/yubico-pam/5719a2f859144948de7b67b6d706d6ed403b219f/ykpamcfg.1.txt https://raw.githubusercontent.com/Yubico/yubico-pam/5719a2f8...