Contents
Why do I need a moduli file for SSH?
So what is this moduli file and why should you keep one of those around? As moduli (5) explains it: The /etc/ssh/moduli file contains prime numbers and generators for use by sshd (8) in the Diffie-Hellman Group Exchange key exchange method.
Is the moduli file the same as the DH key exchange?
The ordinary moduli file is almost the same thing though, a static file provided by the OpenSSH project. These primes are known and most systems on the Internet are probably using the same set. To perform a secure DH key exchange you’d need good primes, but not unique ones.
Is it worth it to replace ssh keygen?
Note: modern SSH uses elliptic-curve Diffie-Hellman, which is more secure in theory. Then replace the contents of your moduli (usually /etc/ssh/moduli) file with the contents of moduli-2048 The ssh-keygen options -G and -T seem to be obsolete.
How are prime numbers used in OpenSSH moduli?
OpenSSH moduli. As moduli (5) explains it: The /etc/ssh/moduli file contains prime numbers and generators for use by sshd (8) in the Diffie-Hellman Group Exchange key exchange method. The Diffi-Hellman key exchange is used in the beginning of SSH sessions to generate a shared secret between the client and the server.
How is the moduli format used in SSHD ( 8 )?
A second primality testing pass, using ssh-keygen -T, provides a high degree of assurance that the numbers are prime and are safe for use in Diffie-Hellman operations by sshd (8). This moduli format is used as the output from each pass. The file consists of newline-separated records, one per modulus, containing seven space-separated fields.
How to generate a moduli file for OpenSSH?
Using the ssh-keygen tool you may generate it yourself. It ends up as over 10000 candidates. Secondly, these are tested and only the safe ones are kept; about 30 entries, at least in this run. The output file contains the ready-to-use moduli file.
What is the sieve for ssh-keygen moduli?
The ssh-keygen (1) moduli candidate generation uses the Sieve of Eratosthenes (flag 0x02).
When to use diffi-Hellman moduli in SSH?
The Diffi-Hellman key exchange is used in the beginning of SSH sessions to generate a shared secret between the client and the server. Obviously, it would be quite important to get that step right. But if my system was missing this file, which modulus was then used and sent to the connecting client? The log message said “using fixed modulus”.