On Windows one can enforce pressing Ctrl+Alt+Del to fire an interrupt that brings up the login window.
When logging onto a console of a Linux computer: How can I tell if this login is a real one or a mocked up on to steal my credentials?
Assuming that you want to be protected against other normal users of the system (if the adversary has root access, all bets are off), your could in principle use a secure attention key:
An operating system's Secure Attention Key is a security tool which is provided as protection against trojan password capturing programs. It is an undefeatable way of killing all programs which could be masquerading as login applications. Users need to be taught to enter this key sequence before they log in to the system.
This related U&L question may be of interest: How can I find the Secure Attention Key (SAK) on my system and can I disable it?
First of all, I'm not sure you can be over confident of the Ctrl+Alt+Del login window on Windows, this is also the role of a virus/trojan to hijack interruption, and implementing it is very possible.
Second, if such mechanism is implemented both on Windows/Linux, it means that administrator privileges are surely compromised.
In Linux, if someone wrote a fake shell to display a prompt and catch your credentials, I guess basic Ctrl+C or Ctrl+Z can be enough, if those signals are not caught to discover the trick. Also entering wrong credentials several time can help you to see any deviation from normal timer behaviour.
Switching between different console like also increase the probability to discover the trick.
But in any case you can not be sure 100% on any kind of system of trustworthiness of your login prompt/window.
You can use ctrl+alt+F1...F7 to go into other tty, and log in from there. You can also use ctrl + z or ctrl + c. However, if someone is trying to steal your login and password using this method, it's still possible that you're being cheated on. Depends on what OS you're using, who had access to it and what kind of access did he have.
Generally, you can never be 100% sure, but if someone did this, I would assume he already has root access - so your login data would be meaningless to him.
A user (even not root) having a physical access to the console can do such a con trick.
Log in through
ssh and check which processes operate on a virtual console you want to log in locally. Whether is it
getty (for a TUI tty) or other legitimate display manager? Has it UID = 0?
If any of two is false, then the hostname
login: banner is certainly forged. But, as state answers already written, it doesn’t help against a wrongdoer having his/her privileges already escalated to
Short answer: you can't tell.
But if the login prompt command has been replaced, it means that the attacker has root access on the machine. In this case he/she could as well:
Therefore worrying whether the login prompt is legitimate or not is a moot point.
As a general rule, you should not login to a machine which you think might be compromised.