Shell script to generate 4096-bit SSH moduli and screen them for use in your /etc/ssh/moduli

generate_moduli.sh

#!/usr/bin/env sh

# Generate and screen 4096-bit moduli file for /etc/ssh/moduli
#
# Refs:
#   `man ssh-keygen`, section MODULI GENERATION
#   `man moduli`
#   https://infosec.mozilla.org/guidelines/openssh

set -eux

mkdir -p /tmp/moduli

# Generate some 4096-bit Sophie Germain primes
echo "Generating 4096-bit moduli candidates."
time ssh-keygen -M generate -O bits=4096 /tmp/moduli/moduli-4096.candidates

# Check that they pass Miller-Rabin primality tests
echo "Screening moduli candidates."
time ssh-keygen -M screen -f /tmp/moduli/moduli-4096.candidates /tmp/moduli/moduli-4096 

# Move the resulting file to the shell's pwd & cleanup temp files.
mv /tmp/moduli/moduli-4096 ./moduli
rm -rf /tmp/moduli

echo "Complete! File 'moduli' created in current working directory."
echo "Remember to move the 'moduli' file to /etc/ssh/moduli if you are satisfied with it, and then restart your SSH daemon with 'systemctl restart ssh'."