PAM worked fine for me for OSX 10.8 on login and sudo and I suspect it would work just as well for 10.7 as well since both now use /etc/pam.d/authorization. I'm still trying to figure it out for 10.6 though.
I largely followed this (macport install + config) https://github.com/Yubico/yubico-pam/wi ... ac-OS-X%29
For sudo I'm guessing you would have updated your /etc/pam.d/sudo file. You can do the same with /etc/pam.d/authorization to control UI login authentication. Here's what mine looks like; I just added the one liner:
auth optional pam_krb5.so use_first_pass use_kcminit
auth optional pam_ntlm.so use_first_pass
auth required pam_yubico.so mode=challenge-response
auth required pam_opendirectory.so use_first_pass nullok
account required pam_opendirectory.so
My yubikey has the first slot configured for OTP and the second for HMAC-SHA1 challenge (without button press).
Make sure you have access to your root console in single user mode before you do anything (cmd+s on bootup. You'll have to "mount -uw /" to be able to write to your /etc/pam.d/authorization file to comment out the yubico pam one liner out if something goes wrong. In other words, be prepared for something going wrong if you're locked out of all your accounts
.I'm still trying to figure out a good authentication stack for /etc/pam.d/screensaver (it doesn't behave like the other ones right off the bat).
Regards
Jeff