>I personally don't at all like the idea of having "pluggable"
>authentication or authorization modules.  It scares the willies out of
>me.  /etc/nsswitch.conf is more than flexible enough, even if it's not
>100% fleshed out with fancy things like RADIUS and LDAP yet.  At least
>with nsswitch I have a 100% guaranteed single place to disable all the
>risky schemes and force everything to use local files, etc.

I guess I don't understand the problem here.

With PAM you can disable the "risky" schemes as well with a single
configuration file (/etc/pam.conf) in nearly all implementations).
What's worries you about this?

--Ken