Implementing two factor auth on linux is actually fairly easy. We use a 15-odd line pam_script script that for ssh logins:

- checks to see if there is a authentication code in a hidden file in your homedir

- if not it validates the password you gave

- if that succeeds generate a 6 digit random number and stores a hash of the number in a hidden file in your homedir and sends it as an SMS to your mobile phone (phone number comes from ldap)

- rejects your login

- you login again, now using the pincode send to your mobile as a password

- the hidden file now exists and the pincode you entered is hashed and compared to the hash stored in the file before

- if they match, your allowed to login.

Simple to implement, fairly strong security wise, logical extension to password-only authentication, no additional account management overhead over standard ldap, reasonable user friendly and very cheap.

We use it also in combination with nomachines nx for remote desktop access.

[edit: formatting]