Hello,

iRony does not log failed login attempts to /var/log/iRony/userlogins, if the user name does exist. In constrast to that, a log entry is emitted, if the user name does not exist.

Reproducing is easy: Open the DAV interface with a browser, enter an existing user name, but wrong password. Have a look into /var/log/iRony/userlogins.

That opens the door to brute force attacks when the user name is known.

Version: iRony-0.4-1.19.el7.kolab_16.noarch