I have a raspberry pi 3B v1.2 which I want to use as a headless server, downloaded a new version of raspbian jessie lite (2017-04-10), wrote it to the micro SD card, then created a new password with salt using this Python script :
$ python -c "import crypt, getpass, pwd; \ print crypt.crypt('password', '\$6\$saltsalt\$')"
Then replaced the hash for user pi (which was for the old password 'raspberry') in /etc/shadow with the new one and then (unmounted and) put the SD card back in the raspberry, switched on, got network and tried to login with ssh.
The new password of which the hash now existed in the /etc/shadow file was not accepted, I still had to log in with the old password which very surprisingly was still valid.
I don't like to leave a raspberry with its default credentials open for attack on the internet upon its first boot. That's why I want to change the default password into something more difficult prior to its first boot.
What did I do wrong, and how can I obtain the goal of changing the password pre-emptively?