#1117705 systemd-homed: Possible user enumeration via response timing of login attempts

Package:
systemd-homed
Source:
systemd-homed
Description:
home area manager
Submitter:
Veiko Aasa
Date:
2026-06-19 23:05:02 UTC
Severity:
normal
#1117705#5
Date:
2025-10-10 03:19:55 UTC
From:
To:
Dear Maintainer,

Installed the package systemd-homed and then created a user with the command
`homectl create testuser`.

It is possible to probe available users by measuring time of failed SSH logins.
For unknown user, login attempts takes always below 5 seconds:
```
/> time -p  sshpass -p 'wrong_password' ssh someuser@IP/
Permission denied, please try again.
real 1.63
user 0.00
sys 0.01
```

For known user, login attempts take always over 10 seconds:
```
/> time -p  sshpass -p 'wrong_password' ssh testuser@IP                                                                /
Permission denied, please try again.
real 14.64
user 0.01
sys 0.00
```

Expected that login times are in similar range for both known and unknown users.

Best regards,
Veiko Aasa

#1117705#12
Date:
2026-04-29 14:36:55 UTC
From:
To:
duplicate #1117704