options for centralized 'passwd' database for a diskless lab ?

as per the subjects, what options do i have to set a centralized
'passwd' database for a lab with FreeBSD diskless machines ?

In the past (4.x times) i used YP/NIS which did the job but was
highly insecure (all traffic unencrypted) and also a bit of a pain to configure.
It was convenient though because it let users change their
password and other info just using the passwd command.

I have been browsing around a bit, and i see that pam_* (tried pam_radius)
can do for the authentication part but not for the other info;
nss_* seems to be a better suit but the only thing i see is nss_ldap
and i am not familiar with the latter.

So any suggestions or pointers to pages describing what to do ?

cheers
luigi