nixos: add config.services.openssh.moduliFile option so that users can replace...
nixos: add config.services.openssh.moduliFile option so that users can replace the default file from OpenSSH The man page for ssh-keygen(1) has a section "MODULI GENERATION" that describes how to generate your own moduli file. The following script might also be helpful: | #! /usr/bin/env bash | | moduliFiles=() | | generateModuli() | { | ssh-keygen -G "moduli-$1.candidates" -b "$1" | ssh-keygen -T "moduli-$1" -f "moduli-$1.candidates" | rm "moduli-$1.candidates" | } | | for (( i=0 ; i <= 16 ; ++i )); do | let bitSize="2048 + i * 128" | generateModuli "$bitSize" & | moduliFiles+=( "moduli-$bitSize" ) | done | wait | | echo >moduli "# Time Type Tests Tries Size Generator Modulus" | cat >>moduli "${moduliFiles[@]}" | rm "${moduliFiles[@]}" Note that generating moduli takes a long time, i.e. several hours on a fast machine! This patch resolves https://github.com/NixOS/nixpkgs/pull/5870.
parent
0c35edb2
Please register or sign in to comment