My company does a lot of automated file transfers over SSH/sftp with banks, etc. A recent SSH upgrade on a server dropped support for the old/weak diffie-helman-group1-sha1 key exchange protocol in response to the recent Logjam attack.

Most of the organizations we work with support the diffie-hellman-group-exchange-sha1 and diffie-hellman-group-exchange-sha256 protocols. However, our /etc/ssh/moduli file contains some numbers weaker than what some servers want, so we get periodic connection failures when our server happens to pick a weaker number from the current file.

So now I am looking at generating a new /etc/ssh/moduli file and removing the weaker numbers to eliminate the possible failure. What I want to know is if we can replace the existing /etc/ssh/moduli file without impacting our already-generated keys that we have exchanged with others. I've read some other posts like Consequences of tampered /etc/ssh/moduli, but they aren't really clear on this point.

From what I have read, I think I am fine to do this since /etc/ssh/moduli is used primarily when negotiating an individual SSH connection, but I'd like some other opinions first.

You'll be fine. /etc/ssh/moduli is only used by sshd:

The /etc/ssh/moduli file contains the system-wide Diffie-Hellman prime moduli for sshd(8).

sshd has nothing to do with client keys that you are using to connect to other machines.

What I want to know is if we can replace the existing /etc/ssh/moduli file without impacting our already-generated keys that we have exchanged with others.

The moduli numbers do not have any connection with server host keys nor with clients authentication keys. The host keys are used for host verification, the authentication keys are used for client authentication, but diffie hellman key exchange is totally different algorithm (ok, not so totally, it is public key cryptography, but it is NOT based on any of the previously mentioned keys RFC4419).

This means that your previously generated keys are not affected.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.