managed to setup the plone login with SQLPASPlugin

Thanks for the links at http://blog.fourdigits.nl/using-sqlpasplugin-for-mysql-user-authenticating

This helped me to authenticate crypted password stored in mysql, instead of put them inside ZODB file.

One point to note is the hack of valid function can be changed to the single below:

return reference == crypt.crypt(attempt, reference)

and I also do import crypt at the head of this file encrypt.py, it's for safe :)