Remove small dh primes

[rndmh3ro]

Thanks to debops!
https://github.com/debops/ansible-sshd/

[angrox]

Yeah, thanks! This needs to be merged first to fix the inspec tests.

[nodiscc]

Hi, can you help me understand this change better?

The debops/ansible-sshd changelog states

• Automatically remove Diffie-Hellman parameters from :file:/etc/ssh/moduli which
  are smaller than the size specified in sshd_moduli_minimum variable (by
  default 2048 bits). [drybjed_]

• When are such weak DH params generated? Can I prevent generating weak params in the first place?
• I understand this is a mitigation against Logjam? Maybe it should be stated in the commit message or somewhere for future reference.

Ping @drybjed who introduced the change in debops/ansible-sshd.

[drybjed]

@nodiscc The /etc/ssh/moduli file on Debian is provided by the openssh-client package (source). Actually I just checked and it's marked as a ConfFile, so the debops.sshd role will have to divert the original before changing it... Anyway, because it's a static file, you cannot "prevent" it being present, unless you create and provide your own custom openssh-client package. And yes, it's a mitigation of the Logjam issue in relation to the SSH protocol. It is probably a good idea to add a small explanation to the role documentation.

[rndmh3ro]

Thanks, I'll update the docs, too!