There is a SAVAUT command that does it. I wrote a CL program to basically migration one system to another (during an upgrade, for example) and we did not loose passwords.

SAVSECDTA / RSTUSRPRF does keep passwords. The other thing I remember doing, at one point, is using QPWDVLDPGM to send the password to the remote system(s) to keep them all synchronized. Nowadays you should probably look at enterprise identity management (single sign-on).