Two factor - virtual private network

[self.away at gmail.com (self.away)]

We have just set up a pptp vpn (remote user at home dials up to my vpn
server at work) using Microsoft RRAS.
Now we are being asked to add extra protection so users have to
authenticate with a certificate in order to authenticate.I know this
is done by adding EAP support to my PPTP vpn.
However adding EAP support means that authentication will only require
a certificate installed at user location and therefore it won't
require user/password authentication anymore.
Does anyone know of how to get vpn server request user/password
authentication and certificate authentication to vpn users?

Is there any other solution for this two-factor authentication using
microsoft windows or linux?

thanks