[pve-devel] applied: [PATCH common 1/2] encrypt_pw: allow yescrypt in addition to sha256

[Thomas Lamprecht]

Am 31.03.25 um 12:03 schrieb Fabian Grünbichler:
> this has been the default for Debian since Bullseye[0].
> 
> besides password setting for the PAM/PVE/PMG realms, this is also used
> to hash cloud-init passwords for Linux VMs, where only a subset of
> prefixes is currently allowed.
> 
> 'j9T' is the default cost factor for yescrypt.
> 
> 0: https://www.debian.org/releases/bullseye/amd64/release-notes/ch-information.en.html#pam-default-password
> 
> Signed-off-by: Fabian Grünbichler <f.gruenbichler at proxmox.com>
> ---
> 
> Notes:
>     instead of opt-in to yescrypt, we could also default to it and opt-into sha256
>     in qemu-server for cloud init.. but that means breaking old qemu-server, as
>     opposed to the change being completely backwards compatible..
> 
>  src/PVE/Tools.pm | 15 +++++++++++++--
>  1 file changed, 13 insertions(+), 2 deletions(-)
> 
>

applied this one, thanks!

It should not hurt and let's use already use this then rather
easily and we can still switch the underlying implementation.