OTP - One Time Password
TFA - Two Factor Authentication
Now that the whole user and certificate management is in 2.0, some nice OTP and TFA would not harm.
Yubikey is only a few dollars.
http://www.yubico.com/products/yubikey/I wonder how difficult it would be to integrate its radius server.
http://code.google.com/p/yms/source/browse/branches/RADIUS_on_Premise/readme.txt-respectively now new only these two:
http://code.google.com/p/yubikey-val-server-php/ - which should be easy to implement.
http://code.google.com/p/yubikey-ksm/ - a bit harder. a data base is needed (mysql or postgres)
http://code.google.com/p/yubikey-ksm/wiki/Installation will tell more