The accounts with passwords are the accounts with a glob of base64 gibberish in the second field:
lp:VvHUV8idZH1uM:9:9:Print Spooler Owner:/var/spool/lp:/bin/sh
This computer appears to be using the traditional, DES-based
crypt(3) password hash. This hash is quite weak by modern standards; if you can't manage to get a root login any other way, you can probably brute-force recover the password, using John the Ripper or similar software. Also, technically that is not base64 but an older, similar encoding, but you probably needn't worry about that.
The distinction between
:!: mentioned in other answers is too new to be relevant to your problem. On a UNIX system this old, there are only three different things that can appear in the password field:
alice::1001:1001:Alice Can Log In Without A Password:/home/alice:/bin/ksh
bob:WSy1W41d4D1Gw:1002:1002:Bob Must Supply A Password:/home/bob:/bin/ksh
carol:ANYTHING ELSE:1003:1003:Carol Cannot Log In At All:/home/carol:/bin/ksh
If the contents of the password field are empty, you can log in with no password.
If the contents of the field are the valid
crypt hash of some password, you can log in with that password.
Otherwise you can't log in as that user.
* is just the conventional thing to use - it's visually obviously not a valid password hash. It was probably picked by whoever wrote the
(The point of having user IDs in the password file who can't log in is that they can still own files, they can still have
cron jobs, and daemons can use
setuid to assume that identity. In fact, it's best practice to run all daemons (that don't have to run as
root) under such user IDs, so that you have some level of assurance that only the daemon is running under that identity.)
(The accounts with
/dev/null in the shell field are locked out against
su to run programs under that user identity, as well as regular login. Nowadays you are much more likely to see
/sbin/nologin used for that purpose; I suspect that on this system the latter does not exist and the former is a shell script.)
(The password for Bob is "bobpassw", encrypted using the old algorithm, but on a modern Linux machine; it might not be what your computer would produce for the same password and salt. One of the reasons the old algorithm is considered no good anymore is it has a hard upper limit of 8 characters in a password.)
(I know the system is really old because it's using DES-based password hashing, because it isn't using a shadow file, and because root's shell is
/bin/ksh rather than anything newer and more ergonomic.)