When a user try to login via a console and enter an unknown user name, I have seen that
agetty try to contact the dns server. I do not know what agetty is looking for. After manipulating nsswitch.conf I have seen that it was to identify an host.
This behaviour is scaring. I don't know what information agetty sends to the dns server but if it tries to identify an host with the wrong user-name, the system has a HUGE security breach. Often, users type their password in place of the user name so if
agetty send this user name to the dns server it means the external dns server has received many passwords!
When a wrong user name is provided, why
agetty try to get an host name and what information is sent over the network?