i don't think there is a portable way for setting passwords, so making sure /usr/bin/passwd is executed (no shells involved) and disallowing all other channels is the only portable thing we could do. -m