[PATCH docs v2 2/2] pveum: document that the pve realm now uses yescrypt

[Shannon Sterz <s.sterz@proxmox.com>]

and document that passwords will be updated on login.

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---

Notes:
    we may want to implement a scheme similar to pbs and pdm where
    passwords are updated to the latest hashing scheme on log in,
    requiring less user interaction.

 pveum.adoc | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/pveum.adoc b/pveum.adoc
index d089cb6..b970f1e 100644
--- a/pveum.adoc
+++ b/pveum.adoc
@@ -147,11 +147,18 @@ these users to log in via their system username and password.
 {pve} Authentication Server::
 
 This is a Unix-like password store, which stores hashed passwords in
-`/etc/pve/priv/shadow.cfg`. Passwords are hashed using the SHA-256 hashing
-algorithm. This is the most convenient realm for small-scale (or even
-mid-scale) installations, where users do not need access to anything outside of
-{pve}. In this case, users are fully managed by {pve} and are able to change
-their own passwords via the GUI.
+`/etc/pve/priv/shadow.cfg`. Passwords are hashed and salted using the yescrypt
+algorithm footnote:[yescrypt https://www.openwall.com/yescrypt/]. It provides
+strong protections against offline password cracking attempts. This realm is the
+most convenient realm for small-scale (or even mid-scale) installations, where
+users do not need access to anything outside of {pve}. In this case, users are
+fully managed by {pve} and are able to change their own passwords via the GUI.
+
+NOTE: Passwords created with older versions of Proxmox VE  used a hashing scheme
+based on SHA-256 that is now considered insecure. If the file
+`/etc/pve/priv/shadow.cfg` shows a password hash starting with `$5$` for an
+account that account still uses such a password. The hash will be updated on the
+next login of that user or when a new password is set.
 
 LDAP::
 
-- 
2.47.3