I need to periodically run a check on the passwords of the users (Redhat 5.0) to verify that all passwords meet minimal standards. I remember seeing a script years ago that grabbed the encrypted passwords from the file and checked if they matched any of the encrypted strings in another file, plus it checked to see if they were just guessable variants of the username, etc.
I would like to find a similar script to run periodically on the servers. We have students putting up webservers for research purposes and sometimes they bypass security measures such as directly inserting the "new" password into the shadow file instead of using passwd().