The best way to do it is to have a separate profile and everything within Salesforce that serves as only the database sync. Then set that profile up in the admin section with the option of never having to change their password. Sometimes your admin won't let you do it this way, but we were lucky enough to set it up like this so we don't have to worry about the sync ever going down.