Wait for device too about pam-u2f

[thorduri]

The cue parameter is to remind you to touch the device for the authentication to take place.

interactive is to prompt (if no devices are found) and wait for a device to be inserted, so you might
want something along the lines of:

auth required pam_u2f.so cue interactive

I'll look into clarifying the documentation.

[gdamjan]

I've tried that combination, and it's a bit annoying to have to press ENTER when it could theoretically find out that by itself

[Cysioland]

Same here.

[LinuxOnTheDesktop]

Similarly, consider the following. At present, on Linux, at the login screen, if login fails because the Yubikey is not inserted, one gets the message 'invalid password' (or whatever similar message, to that effect, the installed login manager generates upon authentication failure). But an invalid password is not the problem. The lack of the physical key is the problem. So the user being told the real problem - at least if he/she has set some config flag, earlier - would be good.

Note also that at present, at least on my system, two-factor authentication with Yubikey, at login, does not work properly anyway (= #137).