How to check for empty passwords?

Question

Looking at all the ssh-login attempts by script-kiddies I assume that there are messed up systems connected to the internet that have password-less accounts set up.

But how to check a Linux/Unix system for such accounts (perhaps created by a broken installer script, a confused admin or something like this)?

As first approximation I can think of something like:

$ grep '^[^:]\+::' /etc/passwd /etc/shadow

Prints all accounts with an empty password - but perhaps on the concrete system such accounts are not even a problem because no program accepts empty entries - c.f. password(5):

However, some applications which read the /etc/passwd file may decide not to permit any access at all if the password field is blank.

But what about hashed empty strings as passwords (e.g. crypt(""))?

How to check for them?

And how to check accounts when more sophisticated account databases are in use (NIS, LDAP, ...)?

Answer 1

An easy way to find encrypted empty or weak passwords is to use a password cracker like John the Ripper.

If you are using NIS or LDAP you need first to extract the password hashes from the database - one way is via getent, see the answer from maxschlepzig

Answer 2

Addressing the last part of the question:

getent abstracts away database specifics, e.g. you can use

$ getent passwd
$ getent shadow

to access these databases independent of the configured mechanism (files, LDAP, NIS ...).