This question already has an answer here:
- How bad is exposing valid user names? 3 answers
I've been challenged with auditing a systems security on a scenario and giving various areas we have to audit. Most of which were easy to understand and to provide vulnerabilities as well as mitigating them. However One of them is usernames, in which I have no clue whatsoever. I was guided and told to use sudo su and less /etc/passwd to see a list of usernames, easy enough.
The only potential vulnerability is that you can't crack/use a password to gain access to an account if you don't have a username, so what could anyone do to mitigate that? It's had me stumped for weeks.