We're using public key authentication in combination with the Yubico pam for our servers.
Is it possible to temporarily (e.g. 1 minute) skip the Yubico pam for subsequent authentications when a user has authenticated successfully once?
Background: Our deployment script is opening multiple SSH connections, each requiring the user to supply his Yubikey token. In the best case this is just inconvenient, in the worst case this is breaking our deployment currently (due to timing issues).
The deploy user is non-privileged, but still I cannot (and don't want to) deactivate the Yubikey requirement.
Changing the deployment script may be possible but requires lots of work. So if it's possible to cover this with the PAM only, that would be a huge advantage.
Open to other suggestions/workarounds for this.