Looking at all the ssh-login attempts by script-kiddies I assume that there are messed up systems connected to the internet that have password-less accounts set up.

But how to check a Linux/Unix system for such accounts (perhaps created by a broken installer script, a confused admin or something like this)?

As first approximation I can think of something like:

$ grep '^[^:]\+::' /etc/passwd /etc/shadow

Prints all accounts with an empty password - but perhaps on the concrete system such accounts are not even a problem because no program accepts empty entries - c.f. password(5):

However, some applications which read the /etc/passwd file may decide not to permit any access at all if the password field is blank.

But what about hashed empty strings as passwords (e.g. crypt(""))?

How to check for them?

And how to check accounts when more sophisticated account databases are in use (NIS, LDAP, ...)?

  • 1
    No answer, but possibly related; using passwdqc you can enforce a minimum password strength at the moment the password is changed.
    – sr_
    Commented Mar 10, 2012 at 11:05

2 Answers 2


An easy way to find encrypted empty or weak passwords is to use a password cracker like John the Ripper.

If you are using NIS or LDAP you need first to extract the password hashes from the database - one way is via getent, see the answer from maxschlepzig


Addressing the last part of the question:

getent abstracts away database specifics, e.g. you can use

$ getent passwd
$ getent shadow

to access these databases independent of the configured mechanism (files, LDAP, NIS ...).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .