In other things that landed into the pipeline: PAM module to avoid transmitting cleartext passwords over the air, relying on bcpasswd :3