Display message - On failed Login.

[cenasmynet]

When you try to login in the teampass with a wrong user name you get "This user do not exist!" and with wrong password "Bad password for this account!", in the 2 cases the message to the user should be the same "Wrong user name or Password!" and internally log the message to the system with the Right message.

This give this kind of info to the end user is a security issue.
The attacker already know that the user name is rigth.

Best regards.

[cenasmynet]

Is this kind of acess logged anyware?

Best regards.

[nilsteampassnet]

No this is currently not. But it can be added.

[cenasmynet]

Can you log that to syslog, the tried username, client ip and the messages (ok or error) . This will help alot.