[marianov]

Any way to do it with an older type of USB token? Like Safenet eTokens?

[qbasic_forever]

The auto lock on device removal with udev rule would be the same idea, in fact you could use any USB device like a basic flash drive if you wanted. Changing PAM's login to use the device for login would require a bit more device-specific stuff--I'd search around to see if Safenet already provides a module to drive PAM auth.

[logix]

This pam_usb fork can be used to set up any USB for authentication: https://www.linuxuprising.com/2021/02/how-to-login-with-usb-...

[marianov]

This are PKI tokens, like smartcards. I would like something tied to a certificate and private key on the device. That would be unforgeable