Specifically, I have installed OpenSSH on both machines:

  • GNU/Linux Debian 9.3 with OpenSSH version 1:7.4p1-10+deb9u2

  • Linux Mint 18.3 with OpenSSH version 1:7.2p2-4ubuntu2.4

In this question, I read the following file is distributed with OpenSSH source code:


Presumably with the package(s). Am I right with assumption, that if I change the file in order to get the weak sizes out, and if I don't hold the openssh-server and / or openssh-client package(s), the file will be overwritten by the their next version update?

And if it will, can I put the single file on hold somehow?

I did the following:

  1. Backed the file up:

    mv /etc/ssh/moduli /etc/ssh/moduli.bak
  2. Filtered out the sizes less than 4095 with:

    awk '$5 >= 4095' /etc/ssh/moduli.bak > /etc/ssh/moduli
  • You've already been told that it's better not to mess with the defaults of ssh here. Consider if some information will be updated in a newer OpenSSH-Version by new contenst of the moduli-file. If you would always just discard any changes to that file, you most certainly LOOSE security and not increase it. – Stefan M Feb 5 '18 at 15:35
  • How about migrating from DH to ECDH which has been available since Jan 2011 (OpenSSH 5.7) if you can assume your clients are as up-to-date as your server? FYI: infosec.mozilla.org/guidelines/openssh – nodakai Feb 23 '18 at 17:00

That depends on your operation system. Debian-like systems ("like" Ubuntu) will most certainly ask you what to do with the file:

Configuration file `/etc/ssh/moduli'
 ==> Modified (by you or by a script) since installation.
 ==> Package distributor has shipped an updated version.
   What would you like to do about it ?  Your options are:
    Y or I  : install the package maintainer's version
    N or O  : keep your currently-installed version
      D     : show the differences between the versions
      Z     : start a shell to examine the situation
 The default action is to keep your current version.
*** moduli (Y/I/N/O/D/Z) [default=N] ?
  • What do you mean by "on hold"? That it should not get overwritten by the update process? That is already the case if you update. Just answer "N" and keep your file during the system upgrade. – Stefan M Feb 5 '18 at 15:33

RedHat systems mark that file as configuration and noreplace:

$ cd
$ yumdownloader --source openssh
$ rpm -i openssh-7.4p1-13.el7_4.src.rpm
$ grep /moduli rpmbuild/SPECS/openssh.spec | head -1
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ssh/moduli

so will not clobber any local changes. Package updates will install as /etc/ssh/moduli.rpmnew, which an admin may need to review versus the customized one.

However do note the warning in ssh-keygen(1):

 Screened DH groups may be installed in /etc/moduli.  It is important that
 this file contains moduli of a range of bit lengths and that both ends of
 a connection share common moduli.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.