Is it possible on the server to prevent specific principals changing their passwords other than by writing a passwd_check function for kpasswdd? (The situation is a shared id whose password shouldn't be able to be clobbered by users.)