I have to set up a VPN (various clients connecting to a web service on a server, which is also the VPN server) and I want to make sure that no user will share his/her credentials with third parties.

I know that this problem is not solvable completely, but I'd want to set up some additional security checks... Some idea I have:

1) An additional check on MAC address, but... are MAC addresses preserved thru VPN? 2) Some kind of extra identification of the client (User Agent, open ports, I want to make sure that is the very same client I authorized). 3) I would like to avoid commercial solutions like a security token... I realize it would be the perfect solution, but it will be to expensive, I suppose...

Do you feel that these options are viable? Do you have any other ideas? Thanks in advance for your replies!