[SAGE] Security tokens

[Jim Hickstein <jxh@jxh.com>]

OK, so I need to stop allowing reusable password authentication for certain 
systems.  Years ago I got hold of some tokens for around $100 each and 
rolled my own server; SecureID wanted ten grand just for the server 
software, which made my unofficial experiment impossible, even for a start.

Lately I'm starting to talk to ActivCard, having evaluated them in the 
past.  Their server (no price yet) runs on Solaris, but requires Oracle 
(!?) to talk to; administration of the authentication database requires 
Windows; and I haven't really studied client integration yet.  This will be 
for Windows, Mac, and UNIX users (FreeBSD, Linux) hitting my inward SSH and 
VPN servers and a few web servers and maybe Citrix.

What's the most open-standards-friendly of the several commercial systems? 
(I know about S/Key and Opie, but these don't strike me as suitable for 
non-sysadmins to use.)  Which one has the best integration with LDAP and 
PAM and RADIUS and that sort of thing?  Which one works even if there is no 
Microsoft product anywhere in sight, yet supports end users on Windows?

I just might come up with the ten grand this time, if it would buy me 
exactly what I want.  But entirely free (open source) would be fine.