A lab will normaly have some policy on passwords. libpam_cracklib
can be very helpful to enforce some demands on password's strength.
And as the clients have to know, whom to let in and whom to deny, they
have to have access to the userdata and passwords in some way. But as
local situation and demands differ, the answers do so, too.
...disadvantages ...no md5 ...insecure ...
...
...
...ssh ...nss-modules ...cfengine ...