BCP works, you have to set config option "allow updates to system tables" to 1. It's also safest to leave alone the first few suids (sa, probe etc).
A more advanced technique is to rewrite sp_addlogin and sp_password to do this synchronisation for you. But these are system procedures, so you may be better writing a wrapper and calling that, it can in turn call the system sprocs on each server. I guess it depends how your users change password.
This is an age old problem in sybase replication (particularly warm standby) so there are plenty of options out there.
If this is for a warm standby solution then you need to ensure that the suid for a particular login name is always the same on each server, as that is the only link to the actual user account in the database. The database permissions in turn are linked to the user account. So get mixed up suids and you can have different permissions on server A and B.