If you are willing to tell anyone who connects your salt, you could, in principle, run a balanced PAKE using the crypt output.

You could go one step further and have the server store an augmented PAKE authenticator derived from the crypt(3) output.

Here's half an answer: Kerberos.

Which SSH does support, btw.