[PATCH docs] fix #5371: user management: document the PAM service of the PAM realm

[PATCH docs] fix #5371: user management: document the PAM service of the PAM realm

[Michal Fox]

Since pve-access-control commit 01f191c ("fix #1670: change PAM service
name to project specific name"), the PAM realm authenticates with the
PAM service name 'proxmox-ve-auth'. This allows changing the PAM
configuration for logins to Proxmox VE only, for example to not allow
logins of users with an empty password, which the default 'nullok'
option of pam_unix in common-auth does. But this is only mentioned in
the commit message.

Document the service name, the fallback to the 'other' service if no
such configuration exists, and that this configuration is local to each
node, like the system users.

Signed-off-by: Michal Fox <me@dualfroz.com>
---

Notes:
    checked in a Debian trixie container with the PAM realm plugin: without
    /etc/pam.d/proxmox-ve-auth, a user with an empty password could log in
    with any password, as in the bug. with a copy of /etc/pam.d/other, with
    common-auth inlined without 'nullok', this login failed, while the one
    of a user with a password still worked.
    
    rendered the chapter with asciidoc, without new warnings.

 pveum.adoc | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pveum.adoc b/pveum.adoc
index d089cb6..49cfd68 100644
--- a/pveum.adoc
+++ b/pveum.adoc
@@ -184,6 +184,14 @@ endpoint only apply to the local node and not cluster-wide. Even though {pve}
 has a multi-master design, using different passwords for different nodes can
 still offer a security benefit.
 
+{pve} uses the PAM service name `proxmox-ve-auth` to authenticate users of this
+realm. This allows changing the PAM configuration only for logins to {pve},
+without affecting other services like the login on the console or via SSH, by
+creating the file `/etc/pam.d/proxmox-ve-auth`. If this file does not exist,
+PAM uses the configuration of the `other` service, so a copy of
+`/etc/pam.d/other` is a good starting point. Like the system users, this
+configuration is local to each node.
+
 In terms of configurability, an administrator can choose to require two-factor
 authentication with logins from the realm and to set the realm as the default
 authentication realm.
-- 
2.43.0