Re: [PATCH docs v2 2/2] pveum: document that the pve realm now uses yescrypt

[Maximiliano Sandoval <m.sandoval@proxmox.com>]

Comments below.

Shannon Sterz <s.sterz@proxmox.com> writes:

> and document that passwords will be updated on login.
>
> Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
> ---
>
> Notes:
>     we may want to implement a scheme similar to pbs and pdm where
>     passwords are updated to the latest hashing scheme on log in,
>     requiring less user interaction.
>
>  pveum.adoc | 17 ++++++++++++-----
>  1 file changed, 12 insertions(+), 5 deletions(-)
>
> diff --git a/pveum.adoc b/pveum.adoc
> index d089cb6..b970f1e 100644
> --- a/pveum.adoc
> +++ b/pveum.adoc
> @@ -147,11 +147,18 @@ these users to log in via their system username and password.
>  {pve} Authentication Server::
>  
>  This is a Unix-like password store, which stores hashed passwords in
> -`/etc/pve/priv/shadow.cfg`. Passwords are hashed using the SHA-256 hashing
> -algorithm. This is the most convenient realm for small-scale (or even
> -mid-scale) installations, where users do not need access to anything outside of
> -{pve}. In this case, users are fully managed by {pve} and are able to change
> -their own passwords via the GUI.
> +`/etc/pve/priv/shadow.cfg`. Passwords are hashed and salted using the yescrypt
> +algorithm footnote:[yescrypt https://www.openwall.com/yescrypt/]. It provides
> +strong protections against offline password cracking attempts. This realm is the

nit: Perhaps /protections/protection/?

> +most convenient realm for small-scale (or even mid-scale) installations, where
> +users do not need access to anything outside of {pve}. In this case, users are
> +fully managed by {pve} and are able to change their own passwords via the GUI.
> +
> +NOTE: Passwords created with older versions of Proxmox VE  used a hashing scheme

nit: This should be '{pve}' rather than 'Proxmox VE '.

> +based on SHA-256 that is now considered insecure. If the file

nit: By whom? Is there any good source to link here?

> +`/etc/pve/priv/shadow.cfg` shows a password hash starting with `$5$` for an
> +account that account still uses such a password. The hash will be updated on the
> +next login of that user or when a new password is set.
>  
>  LDAP::

-- 
Maximiliano