#1117704 systemd-homed: Possible user enumeration via response timing of login attempts

Package:
systemd-homed
Source:
systemd-homed
Description:
home area manager
Submitter:
Veiko Aasa
Date:
2026-06-19 23:05:02 UTC
Severity:
normal
#1117704#5
Date:
2025-10-10 03:14:17 UTC
From:
To:
Dear Maintainer,

I installed the package systemd-homed and then created a user using the command
`homectl create testuser`.

It is possible to probe available users by measuring time of failed SSH logins.
For unknown user, login attempts takes always below 5 seconds:
```
Permission denied, please try again.
real 1.63
user 0.00
sys 0.01
For known user, login attempts take always over 10 seconds:
```
Permission denied, please try again.
real 14.64
user 0.01
sys 0.00
```
Expected that login times are in similar range for both known and unknown users.
Best regards,
Veiko Aasa
#1117704#12
Date:
2026-04-29 14:42:47 UTC
From:
To:
severity minor