Kind of interesting but I think installing fail2ban will reduce the severity quite a bit. However it still allows an attacker to figure out if a username is val

Kind of interesting but I think installing fail2ban will reduce the severity quite a bit. However it still allows an attacker to figure out if a username is valid or not (just not mass enumerate all the users). I guess this is just information leakage due to a timing attack.