This is a trace of a default script (introduced in the November 2016 Raspbian release) which checks if you changed the password for the user `pi`.

The script is stored in `/etc/profile.d/sshpasswd.sh` and displays a warning if the SSH deamon was turned on, but the password for the `pi` user had not been changed from the default one (`raspberry`). It is called on each login.

The script in its original form:

    check_hash ()
    {
            local SHADOW="$(sudo -n grep -E '^pi:' /etc/shadow 2>/dev/null)"
            test -n "${SHADOW}" || return 0
            local SALT=$(echo "${SHADOW}" | sed -n 's/pi:\$6\$//;s/\$.*//p')
            local HASH=$(mkpasswd -msha-512 raspberry "$SALT")
    
            if systemctl is-active ssh -q && echo "${SHADOW}" | grep -q "${HASH}"; then
                    echo
                    echo "SSH is enabled and the default password for the 'pi' user has not been changed."
                    echo "This is a security risk - please login as the 'pi' user and type 'passwd' to set a new password."
                    echo
            fi
    }
    
    check_hash
    unset check_hash

----

In Raspbian Stretch the script has been changed to a one checking existence of `/run/sshwarn` file (on the other hand, created/deleted at boot time). It doesn't check the `/etc/shadow` on each login, but on the other hand if someone used an automated tool to change the password, they need also to explicitly remove the file, or reboot the machine:

    export TEXTDOMAIN=Linux-PAM
    
    . gettext.sh
    
    if [ -e /run/sshwarn ] ; then
        echo
    	echo $(/usr/bin/gettext "SSH is enabled and the default password for the 'pi' user has not been changed.")
    	echo $(/usr/bin/gettext "This is a security risk - please login as the 'pi' user and type 'passwd' to set a new password.")
    	echo
    fi