Make MKPASSWD use the new PBKDF2 crypt()ing, deny MKPASSWD to non-operators