[PATCH docs 2/2] pveum: note that passwords set with old versions may use insecure hashes

[Shannon Sterz <s.sterz@proxmox.com>]

and describe how to remidiate that issue.

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---

Notes:
    we may want to implement a scheme similar to pbs and pdm where
    passwords are updated to the latest hashing scheme on log in,
    requiring less user interaction.

 pveum.adoc | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pveum.adoc b/pveum.adoc
index 53cb992..f3b68c2 100644
--- a/pveum.adoc
+++ b/pveum.adoc
@@ -154,6 +154,13 @@ most convenient realm for small-scale (or even mid-scale) installations, where
 users do not need access to anything outside of {pve}. In this case, users are
 fully managed by {pve} and are able to change their own passwords via the GUI.
 
+NOTE: Passwords created with versions of Proxmox VE that used a
+libpve-common-perl version older than 8.3.1 used a hashing scheme based on
+SHA-256 that is now considered insecure. If the file `/etc/pve/priv/shadow.cfg`
+shows a password hash starting with `$5$` for an account, setting a new password
+for that account is recommended. The new password will then be stored using
+yescrypt (the hash will start with `$y$`).
+
 LDAP::
 
 LDAP (Lightweight Directory Access Protocol) is an open, cross-platform protocol
-- 
2.47.3