If you use RSA SecurID token for VPN, if it is Radius-based, you need to take the PAM module from Yubico: http://code.google.com/p/yubico-pam/
If you use SSL-based VPN, you can take the client SDK to front all the traffic and do necessary tasks (set a cookie, set the response, ...) upon a successful sign-in.
http://www.yubico.com/developers/clients/
If you use that for web apps, that's simple, take Yubico SDK above, do the validation and you are done.
If you want to host your own Yubico OTP validation server, take the Yubico server SDK, import the AES keys and host it on a fast server:
http://www.yubico.com/developers/library/
