Regenerate /etc/ssh/moduli for modern openssh

ssh-regen-moduli

#!/usr/bin/env bash
set -euo pipefail
# This script supports openssh 8.2+
(( ! UID )) || exec /usr/bin/sudo "$0" "$@"
var=${0//[^a-zA-Z0-9_]/_}
eval [ "\${$var-}" ] || exec /usr/bin/env ${var}=1 /usr/bin/flock -en "$0" "$0" "$@"
bits=${1:-4096}
min_bits=$((bits - 1))

moduli::generate() {
  /usr/bin/ssh-keygen -M generate "$@" /dev/stdout
}

moduli::screen() {
  /usr/bin/ssh-keygen -M screen -f "$1" "$2"
}

moduli::safe() {
  [ ! -e moduli ] || /usr/bin/awk "\$5 >= $min_bits" moduli
}

time {
  cd /etc/ssh
  set -x
  moduli::screen <(moduli::generate -O bits=$bits) moduli.generated
  /usr/bin/cat <(moduli::safe) >> moduli.generated
  /usr/bin/mv -f moduli.generated moduli
}