This setting enables linux login with your U2F device

system-auth

#%PAM-1.0

auth       required                    pam_faillock.so      preauth
# Optionally use requisite above if you do not want to prompt for the password
# on locked accounts.

# The following 2 lines enables you to login with both Yubikey and password
# Thanks: https://cromwell-intl.com/cybersecurity/yubikey/pam_u2f.html
auth       sufficient                  pam_unix.so try_first_pass nullok
auth       sufficient                  pam_u2f.so cue
#auth       [success=2 default=ignore]  pam_unix.so          try_first_pass nullok
#-auth      [success=1 default=ignore]  pam_systemd_home.so
auth       [default=die]               pam_faillock.so      authfail
auth       optional                    pam_permit.so
auth       required                    pam_env.so
auth       required                    pam_faillock.so      authsucc
# If you drop the above call to pam_faillock.so the lock will be done also
# on non-consecutive authentication failures.

-account   [success=1 default=ignore]  pam_systemd_home.so
account    required                    pam_unix.so
account    optional                    pam_permit.so
account    required                    pam_time.so

-password  [success=1 default=ignore]  pam_systemd_home.so
password   required                    pam_unix.so          try_first_pass nullok shadow sha512
password   optional                    pam_permit.so

session    required                    pam_limits.so
session    required                    pam_unix.so
session    optional                    pam_permit.so

You have to generate key file with your Yubikey

mkdir -p ~/.config/Yubico
# if your first key
pamu2fcfg > ~/.config/Yubico/u2f_keys
# if your backup key, use the following instead of the above
# pamu2fcfg -n >> ~/.config/Yubico/u2f_keys

refs: https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F