would like to lock "random" users out of the services that are hosted on 
machines here and remember LLNL, etc, using a RSA secureID to effect 
this back in the day: you had to enter your secureID string before being 
able to ssh into your user account through the firewall. i am aware that 
the secureID uses a closed-source algorithm to generate its codes and is 
thus, IMO, not a desirable solution. the goal is to allow only users 
with (1) a hardware token and (2) the correct passwords to access 
services (IMAPS, etc) on openbsd machines.

a list of OTPs would be sufficient if i didn't think i'd end up 
regularly issuing new lists to users. if there is any "good" solution of 
the sort i describe above, i would appreciate pointers from more 
knowledgeable folks.

cheers,
jake

--