Removing the automatic connection for 802.1X via terminal
It took me some hours to learn that it's a boolean value (and not just 0 or 1 as 'defaults' would report) but finally i came up with the following LoginHook which does the trick. As LoginHooks get
executed as root user, you have to 'su' to the user currently being logged
in before running the script below. As Michele points out below, that username
is available as $1 to the Hook-Script running as root.
It seems to be a user byHost-Setting, although SystemPrefs would ask for a admin password to tweak this setting...
My hook script being executed in user-context looks like this:

#!/bin/sh

if [ `whoami` = "root" ]; then
  echo "$0: Must run as regular user, not root! QUIT."
  exit 1
fi

# write new setting 
defaults write -currentHost com.apple.network.eapolcontrol EthernetAutoConnect -bool false


Using opensnoop(1) or fs_usage(1) I could not see any other files being modified. Hope it helps.