@jeremyje Sure, I can add a comment.

Unfortunately, there is no spec that I can find that defines how this stuff is used at all. From the manpage of shadow it says that "!" or "*" or any other invalid crypt can be used. http://linux.die.net/man/5/shadow

And ssh just takes it upon itself to use "!" as its locked account token: https://github.com/openssh/openssh-portable/blob/master/configure.ac#L705

If this token is used then it simply denies logins: https://github.com/openssh/openssh-portable/blob/master/auth.c#L151

/cc @marineam