This is a trace of a default script (introduced in the November 2016 Raspbian release) which checks if you changed the password for the user pi.
The script is stored in /etc/profile.d/sshpasswd.sh and displays a warning if the SSH deamon was turned on, but the password for the pi user had not been changed from the default one (raspberry). It is called on each login.
The script in its original form:
check_hash ()
{
local SHADOW="$(sudo -n grep -E '^pi:' /etc/shadow 2>/dev/null)"
test -n "${SHADOW}" || return 0
local SALT=$(echo "${SHADOW}" | sed -n 's/pi:\$6\$//;s/\$.*//p')
local HASH=$(mkpasswd -msha-512 raspberry "$SALT")
if systemctl is-active ssh -q && echo "${SHADOW}" | grep -q "${HASH}"; then
echo
echo "SSH is enabled and the default password for the 'pi' user has not been changed."
echo "This is a security risk - please login as the 'pi' user and type 'passwd' to set a new password."
echo
fi
}
check_hash
unset check_hash
In Raspbian Stretch the script has been changed to a one checking existence of /run/sshwarn file (on the other hand, created/deleted at boot time). It doesn't check the /etc/shadow anymoreon each login, but on the other hand if someone used an automated tool to change the password, they need also to explicitly remove the file, or reboot the machine:
export TEXTDOMAIN=Linux-PAM
. gettext.sh
if [ -e /run/sshwarn ] ; then
echo
echo $(/usr/bin/gettext "SSH is enabled and the default password for the 'pi' user has not been changed.")
echo $(/usr/bin/gettext "This is a security risk - please login as the 'pi' user and type 'passwd' to set a new password.")
echo
fi