My company does a lot of automated file transfers over SSH/sftp with banks, etc. A recent SSH upgrade on a server dropped support for the old/weak diffie-hellman-group1-sha1 key exchange protocol in response to the recent Logjam attack.
Most of the organizations we work with support the diffie-hellman-group-exchange-sha1 and diffie-hellman-group-exchange-sha256 protocols. However, our /etc/ssh/moduli file contains some numbers weaker than what some servers want, so we get periodic connection failures when our server happens to pick a weaker number from the current file.
So now I am looking at generating a new /etc/ssh/moduli file and removing the weaker numbers to eliminate the possible failure. What I want to know is if we can replace the existing /etc/ssh/moduli file without impacting our already-generated keys that we have exchanged with others. I've read some other posts like Consequences of tampered /etc/ssh/moduli, but they aren't really clear on this point.
From what I have read, I think I am fine to do this since /etc/ssh/moduli is used primarily when negotiating an individual SSH connection, but I'd like some other opinions first.
