From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id F1DF91FF0C0 for ; Wed, 21 Oct 2026 13:37:19 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 78CC6215CA; Wed, 21 Oct 2026 13:37:19 +0200 (CEST) From: Shannon Sterz To: pmg-devel@lists.proxmox.com Subject: [PATCH pmg-api 1/2] pam/pmg realm: use yescrypt for new password hashes Date: Wed, 21 Oct 2026 13:37:04 +0200 Message-ID: <20261021113704.232095-3-s.sterz@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261021113704.232095-2-s.sterz@proxmox.com> References: <20261021113704.232095-2-s.sterz@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1792582634888 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.756 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: 7RQYZO5VIAIHDEUIP5VJAUSPTLQ4SIPH X-Message-ID-Hash: 7RQYZO5VIAIHDEUIP5VJAUSPTLQ4SIPH X-MailFrom: s.sterz@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox Mail Gateway development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: and in the case of the pmg realm, update old stored hashes on authentication. this should improve the security of passwords. yescrypt is the default in Debian since the Bullseye release [1]. [1]: Section 5.1.4, https://www.debian.org/releases/bullseye/amd64/release-notes.en.txt Signed-off-by: Shannon Sterz --- Notes: note that the change for pam also means that previously if a new password for a pam user was set via the PVE API, the hash function used for that password would effectively have been downgraded. src/PMG/API2/Users.pm | 2 +- src/PMG/AccessControl.pm | 2 +- src/PMG/UserConfig.pm | 9 ++++++++- 3 files changed, 10 insertions(+), 3 deletions(-) diff --git a/src/PMG/API2/Users.pm b/src/PMG/API2/Users.pm index e638ae8..a973653 100644 --- a/src/PMG/API2/Users.pm +++ b/src/PMG/API2/Users.pm @@ -118,7 +118,7 @@ __PACKAGE__->register_method({ foreach my $k (keys %$param) { my $v = $param->{$k}; if ($k eq 'password') { - $entry->{crypt_pass} = PVE::Tools::encrypt_pw($v); + $entry->{crypt_pass} = PVE::Tools::encrypt_pw($v, "y"); } else { $entry->{$k} = $v; } diff --git a/src/PMG/AccessControl.pm b/src/PMG/AccessControl.pm index f4ac743..6fa89de 100644 --- a/src/PMG/AccessControl.pm +++ b/src/PMG/AccessControl.pm @@ -103,7 +103,7 @@ sub set_user_password { my $cmd = ['usermod']; - my $epw = PVE::Tools::encrypt_pw($password); + my $epw = PVE::Tools::encrypt_pw($password, "y"); push @$cmd, '-p', $epw, $ruid; diff --git a/src/PMG/UserConfig.pm b/src/PMG/UserConfig.pm index 5ee7333..b2ef417 100644 --- a/src/PMG/UserConfig.pm +++ b/src/PMG/UserConfig.pm @@ -19,6 +19,7 @@ my $config_filename = '/etc/pmg/user.conf'; my $tfa_inotify_file_id = 'pmg-tfa.json'; my $tfa_config_filename = '/etc/pmg/tfa.json'; +my $hash_prefix = "y"; sub new { my ($type) = @_; @@ -351,6 +352,12 @@ sub authenticate_user { if ($data->{crypt_pass}) { my $encpw = crypt($password, $data->{crypt_pass}); die "invalid credentials\n" if ($encpw ne $data->{crypt_pass}); + + # If the password was stored with a different hash function than the currently configured + # one, update it here. + if ($data->{crypt_pass} !~ m/^\$${hash_prefix}\$/) { + store_password($class, $config, $realm, $username, $password); + } } else { die "no password set\n"; } @@ -364,7 +371,7 @@ sub set_user_password { lock_config(sub { my $cfg = $class->new(); my $data = $cfg->lookup_user_data($username); # user exists - my $epw = PVE::Tools::encrypt_pw($password); + my $epw = PVE::Tools::encrypt_pw($password, $hash_prefix); $data->{crypt_pass} = $epw; $cfg->write(); }); -- 2.47.3