Shall I hold the openssh packages after modifying /etc/ssh/moduli?

Question

Specifically, I have installed OpenSSH on both machines:

• GNU/Linux Debian 9.3 with OpenSSH version 1:7.4p1-10+deb9u2

• Linux Mint 18.3 with OpenSSH version 1:7.2p2-4ubuntu2.4

In this question, I read the following file is distributed with OpenSSH source code:

/etc/ssh/moduli

Presumably with the package(s). Am I right with assumption, that if I change the file in order to get the weak sizes out, and if I don't hold the openssh-server and / or openssh-client package(s), the file will be overwritten by the their next version update?

And if it will, can I put the single file on hold somehow?

---

I did the following:

1. Backed the file up:

   mv /etc/ssh/moduli /etc/ssh/moduli.bak
   

2. Filtered out the sizes less than 4095 with:

   awk '$5 >= 4095' /etc/ssh/moduli.bak > /etc/ssh/moduli
   

Answer 1

That depends on your operation system. Debian-like systems ("like" Ubuntu) will most certainly ask you what to do with the file:

Configuration file `/etc/ssh/moduli'
 ==> Modified (by you or by a script) since installation.
 ==> Package distributor has shipped an updated version.
   What would you like to do about it ?  Your options are:
    Y or I  : install the package maintainer's version
    N or O  : keep your currently-installed version
      D     : show the differences between the versions
      Z     : start a shell to examine the situation
 The default action is to keep your current version.
*** moduli (Y/I/N/O/D/Z) [default=N] ?

Answer 2

RedHat systems mark that file as configuration and noreplace:

$ cd
$ yumdownloader --source openssh
$ rpm -i openssh-7.4p1-13.el7_4.src.rpm
$ grep /moduli rpmbuild/SPECS/openssh.spec | head -1
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ssh/moduli

so will not clobber any local changes. Package updates will install as /etc/ssh/moduli.rpmnew, which an admin may need to review versus the customized one.

However do note the warning in ssh-keygen(1):

 Screened DH groups may be installed in /etc/moduli.  It is important that
 this file contains moduli of a range of bit lengths and that both ends of
 a connection share common moduli.