Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Looking at all the ssh-login attempts by script-kiddies I assume that there are messed up systems connected to the internet that have password-less accounts set up.

But how to check a Linux/Unix system for such accounts (perhaps created by a broken installer script, a confused admin or something like this)?

As first approximation I can think of something like:

$ grep '^[^:]\+::' /etc/passwd /etc/shadow

Prints all accounts with an empty password - but perhaps on the concrete system such accounts are not even a problem because no program accepts empty entries - c.f. password(5):

However, some applications which read the /etc/passwd file may decide not to permit any access at all if the password field is blank.

But what about hashed empty strings as passwords (e.g. crypt(""))?

How to check for them?

And how to check accounts when more sophisticated account databases are in use (NIS, LDAP, ...)?

share|improve this question
1  
No answer, but possibly related; using passwdqc you can enforce a minimum password strength at the moment the password is changed. –  sr_ Mar 10 '12 at 11:05

2 Answers 2

up vote 5 down vote accepted

An easy way to find encrypted empty or weak passwords is to use a password cracker like John the Ripper.

If you are using NIS or LDAP you need first to extract the password hashes from the database - one way is via getent, see the answer from maxschlepzig

share|improve this answer

Addressing the last part of the question:

getent abstracts away database specifics, e.g. you can use

$ getent passwd
$ getent shadow

to access these databases independent of the configured mechanism (files, LDAP, NIS ...).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.