Adds sshd config for keyboard-interactive pam device

[rcII]

• Adds configuration option for public key authentication with 2FA input
  from a PAM device such as a Yubikey. This will allow keyboard
  interaction from the device only. See the documentation on
  AuthenticationMethods
  here.

[rndmh3ro]

We have almost the same configuration on lines 96-98, except for the :pam-part. What's the difference between these two? Are both needed?

[rcII]

@rndmh3ro the added :pam option only allows authentication from the PAM (yubikey) device itself. From the sshd docs:

	     For keyboard interactive authentication it	is also	possible to
	     restrict authentication to	a specific device by appending a colon
	     followed by the device identifier ``bsdauth'', ``pam'', or
	     ``skey'', depending on the	server configuration.  For example,
	     ``keyboard-interactive:bsdauth'' would restrict keyboard interac-
	     tive authentication to the	``bsdauth'' device.

(Sorry for the crappy formatting). Source: https://www.freebsd.org/cgi/man.cgi?query=sshd_config&sektion=5.
Regarding ChallengeResponseAuthentication and UsePam, this is the mechanism that prompts a challenge response via the PAM interface. The excepted "2FA" outcome is as follows.

1. Authenticate via ssh public key first.
2. Prompt a challenge response from PAM device (Yubikey).
   The user will be prompted as follows:

YubiKey for `foouser':

[rndmh3ro]

Thanks for your explanation!

[rndmh3ro]

Hey @rcII,

Thanks for your PR!

I never used a Yubikey with 2FA and sshd, so my knowledge here is limited.. Hope you can answer my comments.

EDIT:
Also what's with ChallengeResponseAuthentication? And the ssh-option UsePam? Is this needed for 2FA with yubikey? Seems I've got something more to learn here. :)

What I want from a variable like ssh_pam_device is to tell me what exactly it does and it should do everything it needs to.