Super easy to setup and use. About $1/user/month, so fairly cheap.
Does it allow to do "nested" logins? E.g., first login from machine A to machine B, then login from machine B to machine C, while the security token is on machine A?
PAM + OTP. See the Arch Wiki [0], though it's applicable on almost every single distribution. You can use keys for known devices, and use passphrase and OTP for unknown devices if you need to SSH in a bind.