5

Looking at all the ssh-login attempts by script-kiddies I assume that there are messed up systems connected to the internet that have password-less accounts set up.

But how to check a Linux/Unix system for such accounts (perhaps created by a broken installer script, a confused admin or something like this)?

As first approximation I can think of something like:

$ grep '^[^:]\+::' /etc/passwd /etc/shadow

Prints all accounts with an empty password - but perhaps on the concrete system such accounts are not even a problem because no program accepts empty entries - c.f. password(5):

However, some applications which read the /etc/passwd file may decide not to permit any access at all if the password field is blank.

But what about hashed empty strings as passwords (e.g. crypt(""))?

How to check for them?

And how to check accounts when more sophisticated account databases are in use (NIS, LDAP, ...)?

  • 1
    No answer, but possibly related; using passwdqc you can enforce a minimum password strength at the moment the password is changed. – sr_ Mar 10 '12 at 11:05
5

An easy way to find encrypted empty or weak passwords is to use a password cracker like John the Ripper.

If you are using NIS or LDAP you need first to extract the password hashes from the database - one way is via getent, see the answer from maxschlepzig

2

Addressing the last part of the question:

getent abstracts away database specifics, e.g. you can use

$ getent passwd
$ getent shadow

to access these databases independent of the configured mechanism (files, LDAP, NIS ...).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.