/etc/hosts, nsswitch.conf and resolv.conf on Linux

What it is

Every name lookup on Linux goes through the C library's Name Service Switch (NSS). /etc/nsswitch.conf decides which sources are consulted and in what order: files (/etc/hosts, /etc/passwd), dns (servers from /etc/resolv.conf), resolve (systemd-resolved), myhostname, sss, ldap and others. Each source is a shared library (libnss_<name>.so.2).

Attackers touch these files for three reasons: redirect names (point a bank, update server or C2 fallback at their IP via /etc/hosts), block security vendors (resolve EDR and update domains to 127.0.0.1), and persist or steal credentials by adding a malicious NSS module that every process loads for user and host lookups. Changed DNS servers also let them observe or spoof resolution for the whole host.

Where it lives

What it proves

• Which names resolved to which addresses locally, regardless of DNS: /etc/hosts entries override public records for every program that uses NSS.
• That security tooling was deliberately blinded: vendor telemetry, package mirrors or threat intel domains mapped to 0.0.0.0 or 127.0.0.1.
• Which DNS servers the host used, and whether they changed from the organization's resolvers to an attacker-controlled or public resolver.
• That an unexpected NSS source (hosts: files evil dns, passwd: files systemd backdoor) was configured, and that its library exists.
• It does not log individual lookups. Query logs only exist if a local resolver (dnsmasq, unbound, systemd-resolved with debug logging) or network sensor recorded them.

Key fields

# /etc/hosts
127.0.0.1   localhost
203.0.113.50  updates.example-vendor.com
0.0.0.0     telemetry.edr-vendor.example  ingest.edr-vendor.example

# /etc/nsswitch.conf
passwd:  files systemd
hosts:   files myhostname resolve [!UNAVAIL=return] dns

Timestamps

These are plain configuration files with only file system times. /etc/hosts on a server rarely changes after installation, so a recent mtime or ctime stands out; on cloud VMs, cloud-init may rewrite it at every boot if manage_etc_hosts is enabled, which resets the times. systemd-resolved and NetworkManager log server changes and link configuration to the journal with UTC timestamps.

Retention

Edits persist until changed. Generated resolv.conf content under /run is recreated at boot from configuration, so a live resolv.conf that differs from what the configuration would produce was changed at runtime. Package upgrades may replace a modified nsswitch.conf or leave it with a .rpmnew or .dpkg-dist beside it, which conveniently preserves both versions.

Collection

# Dead box
tar -C /mnt/evidence -cpf /cases/2026-017/nameres.tar etc/hosts etc/hosts.* etc/resolv.conf etc/nsswitch.conf* \
  usr/etc/nsswitch.conf etc/host.conf etc/gai.conf etc/systemd/resolved.conf etc/systemd/resolved.conf.d \
  etc/NetworkManager etc/dnsmasq.conf etc/dnsmasq.d etc/unbound 2>/dev/null
ls -la /mnt/evidence/etc/resolv.conf     # record the symlink target

# Live: effective state
getent hosts updates.example-vendor.com
getent ahosts example.org
resolvectl status > /media/ir/resolvectl.txt 2>/dev/null
cp -a /run/systemd/resolve /run/NetworkManager/resolv.conf /media/ir/ 2>/dev/null

UAC collects /etc in full and runs network live-response commands. With Velociraptor, collect the files with Linux.Search.FileFinder.

Parsing

R=/mnt/evidence
grep -vE '^\s*(#|$)' "$R"/etc/hosts | grep -vE '^(127\.0\.[01]\.1|::1|fe00::|ff0[02]::)'
grep -vE '^\s*(#|$)' "$R"/etc/nsswitch.conf
# NSS sources configured versus libraries present, and ownership
grep -hoE '^\w+:.*' "$R"/etc/nsswitch.conf | tr ' ' '\n' | grep -vE ':|\[|^$' | sort -u
ls -la --time-style=full-iso "$R"/usr/lib64/libnss_* "$R"/usr/lib/x86_64-linux-gnu/libnss_* 2>/dev/null
rpm --root "$R" -V glibc 2>/dev/null; dpkg --root="$R" -V libc6 2>/dev/null
journalctl -D "$R"/var/log/journal -u systemd-resolved -u NetworkManager -g 'DNS|nameserver' -o short-iso-precise

Investigator tips

• Any /etc/hosts entry for a public domain needs a business reason. Entries for EDR, antivirus, package mirror or OS update domains pointing to loopback are a defense-evasion indicator in their own right.
• A libnss_*.so.2 that no package owns, or a source name in nsswitch.conf that does not match any installed module, is as serious as an ld.so.preload hijack: every ls -l, id and ssh login loads it.
• resolv.conf as a regular file on a system that normally uses a symlink, or DNS= and Domains=~. in a new resolved.conf.d drop-in, points to deliberate DNS redirection.
• Compare the DNS servers here with outbound UDP/TCP 53 and 853 flows in firewall logs or network telemetry to see whether the host actually used them.
• Check .rpmnew, .rpmsave, .dpkg-old and .dpkg-dist copies next to each file; they are free before-and-after snapshots.