Re: [pmg-devel] [PATCH pmg-api 0/1] user config: password: allows (gost-)yescrypt, hashes

[Stoiko Ivanov <s.ivanov@proxmox.com>]

Hi,

Thank you for the patch and your interest in contributing to Proxmox Mail
Gateway!

question/comment inline:
On Fri, 23 Jan 2026 18:13:16 +0000
Samuel FORESTIER <samuel+dev@forestier.app> wrote:

>  From 208b1364b8b83324aef594eb66794c231e162cb9 Mon Sep 17 00:00:00 2001
> From: Samuel FORESTIER <samuel+dev@forestier.app>
> Date: Fri, 23 Jan 2026 18:45:43 +0100
> Subject: [PATCH pmg-api 0/1] user config: password: allows 
> (gost-)yescrypt hashes
> 
> Dear developers,
> 
> This patch extends user config 'crypt_pass' field validation pattern to 
> support
> yescrypt and gost-yescrypt hash formats (regarding crypt(5) documentation).
> This allows direct synchronization of PAM users to PMG realm, when their
> passwords are hashed using yescrypt.
It is possible to create a user in the PAM realm (just like in our other
products) - then you can simply login with the user - and their password
should be checked by PAM. This has the advantage that you do not duplicate
the password information and it stays consistent.

Currently creating users with realm PAM in the GUI is disabled (afair
simply because we haven't seen reports where people would want to have
many system-users as users in their PMG), but this could potentially be
allowed - if there is a use-case which benefits from this.
see: https://bugzilla.proxmox.com/show_bug.cgi?id=6488 for the request to
hide the realm (expecting it not to be needed)

What is your use-case - how do you create the users on the system, and
would there be any upside for you to keep 2 copies of the password
(compared to having the user@pam directly ask PAM)?

Regarding the patch itself allowing other password-hashes (and maybe
changing the default to yescrypt - as currently recommended by mkpasswd)
might be ok.

Thanks again!
stoiko


> 
> BR
> 
> Samuel FORESTIER (1):
>    user config: password: allows (gost-)yescrypt hashes
> 
>   src/PMG/UserConfig.pm | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>