[PATCH docs 2/2] pmgconfig: document that the pmg realm now uses yescrypt

[Shannon Sterz <s.sterz@proxmox.com>]

and document that passwords will be upgraded on login.

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 pmgconfig.adoc | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/pmgconfig.adoc b/pmgconfig.adoc
index 00a988e..d68d331 100644
--- a/pmgconfig.adoc
+++ b/pmgconfig.adoc
@@ -1271,11 +1271,18 @@ created on the host system with commands such as `adduser`.
 {pmg} Authentication Server::
 
 This is a Unix-like password store, which stores hashed passwords directly in
-`/etc/pmg/user.conf`. Passwords are hashed using the SHA-256 hashing
-algorithm. This is the most convenient realm for small-scale (or even
-mid-scale) installations, where users do not need access to anything outside of
-{pmg}. In this case, users are fully managed by {pmg} and are able to change
-their own passwords via the GUI.
+`/etc/pmg/user.conf`. Passwords are hashed and salted using the yescrypt
+algorithm footnote:[yescrypt https://www.openwall.com/yescrypt/]. It provides
+strong protections against offline password cracking attempts. This is the most
+convenient realm for small-scale (or even mid-scale) installations, where users
+do not need access to anything outside of {pmg}. In this case, users are fully
+managed by {pmg} and are able to change their own passwords via the GUI.
+
+NOTE: Passwords created with older versions of Proxmox Mail Gateway used a
+hashing scheme based on SHA-256 that is now considered insecure. If the file
+`/etc/pmg/user.cfg` shows a password hash starting with `$5$` for an account,
+that account still uses such a password. The hash will be updated on the next
+login of that user or when a new password is set.
 
 OpenID Connect::
 
-- 
2.47.3