synchronizing passwords between samba and vms/unix

[system manager]

What are people's feelings about the best way to sync passwords 
between samba and VMS / Unix?  (Yes, I know this is a VMS list but
I figure a few people have some knowledgable opinions on teh subject
of Unix).

Please excuse the rambling nature of this.

The question I see is how fool proof and how upgrade compliant does
one want to be.

I could pretty easily write a DCL file to get the old and new passwords 
and then run set password and smbpasswd.  And have samba_root:[bin]smbpasswd
point to it, renaming the real executable.

I am much more leary of mucking about with "set password" itself,
I imagine you'd have to use $getuai and $setuai to write the program
that is pointed to by ... hmmm, it's been too long, there is set.exe
and dcl.exe, but what is the file ... ah, dcltables.exe, set.cld,
Interesting, set password has a "prompt_style" qualifier.
In any case setp0 is the image.  

I suppose the only reason to muck about in dcltables is if you wanted
to make changing the smbpasswd optional at the command line rather
than in the program itself.

Directly dealing with setp0.exe is not something I would like to do,
but perhaps putting a program in its place that acted much as the 
dcl script I was thinking of above.  and again put the same thing in
place of samba_root:[bin]smbpasswd.

Well, those are just some thoughts, feel free to critique.

On unix it is possible to have samba call passwd or some other
program to change teh password, but it needs to be called AS ROOT 
(emphasis from the documentation) because it no longer has access
to the plaintext password the user put in.

Do those with more unix experience than I agree with the apparent 
view of the documentation's author that this is a BAD IDEA(TM)?

Thanks for your input.

Robert Morphis