[PATCH access-control v2 1/2] pam/pve: use yescrypt for new password hashes

[Shannon Sterz <s.sterz@proxmox.com>]

and in the case of the pve realm, update old stored hashes on
authentication. this should improve the security of passwords.
yescrypt is the default in Debian since the Bullseye release [1].

[1]: Section 5.1.4,
https://www.debian.org/releases/bullseye/amd64/release-notes.en.txt

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---

Notes:
    note that the change for pam also means that previously if a new
    password for a pam user was set via the PVE API, the hash function
    used for that password would effectively have been downgraded.

 src/PVE/Auth/PAM.pm | 2 +-
 src/PVE/Auth/PVE.pm | 9 ++++++++-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/src/PVE/Auth/PAM.pm b/src/PVE/Auth/PAM.pm
index 8586da5..b67eb03 100755
--- a/src/PVE/Auth/PAM.pm
+++ b/src/PVE/Auth/PAM.pm
@@ -85,7 +85,7 @@ sub store_password {
 
     my $cmd = ['usermod'];
 
-    my $epw = PVE::Tools::encrypt_pw($password);
+    my $epw = PVE::Tools::encrypt_pw($password, 'y');
 
     push @$cmd, '-p', $epw, $username;
 
diff --git a/src/PVE/Auth/PVE.pm b/src/PVE/Auth/PVE.pm
index ab439a8..cd0e5af 100755
--- a/src/PVE/Auth/PVE.pm
+++ b/src/PVE/Auth/PVE.pm
@@ -11,6 +11,7 @@ use PVE::Cluster qw(cfs_register_file cfs_read_file cfs_write_file cfs_lock_file
 use base qw(PVE::Auth::Plugin);
 
 my $shadowconfigfile = "priv/shadow.cfg";
+my $hash_prefix = "y";
 
 cfs_register_file($shadowconfigfile, \&parse_shadow_passwd, \&write_shadow_config);
 
@@ -81,6 +82,12 @@ sub authenticate_user {
         my $encpw =
             crypt(Encode::encode('utf8', $password), $shadow_cfg->{users}->{$username}->{shadow});
         die "invalid credentials\n" if ($encpw ne $shadow_cfg->{users}->{$username}->{shadow});
+
+        # If the password was stored with a different hash function than the currently configured
+        # one, update it here.
+        if ($shadow_cfg->{users}->{$username}->{shadow} !~ m/^\$${hash_prefix}\$/) {
+            store_password($class, $config, $realm, $username, $password);
+        }
     } else {
         die "no password set\n";
     }
@@ -93,7 +100,7 @@ sub store_password {
 
     lock_shadow_config(sub {
         my $shadow_cfg = cfs_read_file($shadowconfigfile);
-        my $epw = PVE::Tools::encrypt_pw($password);
+        my $epw = PVE::Tools::encrypt_pw($password, $hash_prefix);
         $shadow_cfg->{users}->{$username}->{shadow} = $epw;
         cfs_write_file($shadowconfigfile, $shadow_cfg);
     });
-- 
2.47.3