PKI based AAA with PAM+NSS, compatible with traditional username/password schema.