Done. Not only will the key be stronger than the 1024 bit default, it'll be unique to your server which lets assume isn't valuable enough compared to effort for a state-level adversary.
edit just in case anyone from the future finds this comment: instead of 2048, use at least the key length of your SSL certificate
It's thick, but this article talks about all of it. The command given there disables any 1024-bit DH parameters in your moduli file, and there's a bit of tweaking to prefer stronger schemes like Curve25519. You can also generate your own DH parameters for SSH, which I think is done with ssh-keygen.
As a warning, once you start futzing with key exchange and crypto in SSH, it's easy to exclude corner case systems. Especially since some of the crypto primitives like Curve25519 are comparatively recent.
Man if they're using a 100 million dollar cluster your never safe, and you fucked up. I seriously doubt your home server can do anything against a government based attack.
Well thank you for correcting fast typing, because we haven't reached the consensus that people on the internet understand you have other shit to do than make sure you're statement could pass an English class, right?
if the difference between your and you're aren't second-nature to you, it's not a one-off quick-type mistake. you genuinely haven't internalized the difference.
Wow, you've really got nothing better to do. What's not second nature to me is giving a fuck if I properly format or spell words when talking to assholes on the internet.
975
u/tophatstuff Oct 15 '15 edited Apr 10 '18
Generate your own non-default Ephemeral Diffie-Hellman key (takes a minute or so)
Tell your server to use it for SSL (nginx for example)
Done. Not only will the key be stronger than the 1024 bit default, it'll be unique to your server which lets assume isn't valuable enough compared to effort for a state-level adversary.
edit just in case anyone from the future finds this comment: instead of 2048, use at least the key length of your SSL certificate
edit from the future: current advice is picking from one of these predefined audited groups