When a user try to login via a console and enter an unknown user name, I have seen that agetty try to contact the dns server. I do not know what agetty is looking for. After manipulating nsswitch.conf I have seen that it was to identify an host.

This behaviour is scaring. I don't know what information agetty sends to the dns server but if it tries to identify an host with the wrong user-name, the system has a HUGE security breach. Often, users type their password in place of the user name so if agetty send this user name to the dns server it means the external dns server has received many passwords!

When a wrong user name is provided, why agetty try to get an host name and what information is sent over the network?

  • 1
    Use a packet capture tool to answer the second question – I'm sure that information will automatically answer the first. – user1686 Aug 20 '19 at 16:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.