diff --git a/config/rootfiles/core/121/update.sh b/config/rootfiles/core/121/update.sh
index 3ec251292..99c174156 100644
--- a/config/rootfiles/core/121/update.sh
+++ b/config/rootfiles/core/121/update.sh
@@ -60,7 +60,11 @@ rm -rvf \
 sed -i /etc/ssh/sshd_config \
 	-e 's/^#SyslogFacility AUTH$/SyslogFacility AUTH/' \
 	-e 's/^#LogLevel INFO$/LogLevel INFO/' \
-	-e 's/^#StrictModes .*$/StrictModes yes/'
+	-e 's/^#StrictModes .*$/StrictModes yes/' \
+	-e 's/^#RekeyLimit default none$/Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr\
+			MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com\
+			KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256\
+			#RekeyLimit default none/'
 
 # Start services
 /etc/init.d/sshd restart
diff --git a/lfs/openssh b/lfs/openssh
index 7e8468ac9..3043501a2 100644
--- a/lfs/openssh
+++ b/lfs/openssh
@@ -96,6 +96,10 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 		-e 's/^#\?AllowTcpForwarding .*$$/AllowTcpForwarding no/' \
 		-e 's/^#\?PermitRootLogin .*$$/PermitRootLogin yes/' \
 		-e 's/^#StrictModes .*$/StrictModes yes/' \
+		-e 's/^#RekeyLimit default none$/Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr\
+			MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com\
+			KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256\
+			#RekeyLimit default none/' \
 		-e 's|^#\?HostKey /etc/ssh/ssh_host_dsa_key$$||' \
 		-e 's|^#\?HostKey /etc/ssh/ssh_host_ecdsa_key$$||' \
 		-e 's|^#\?HostKey /etc/ssh/ssh_host_ed25519_key$$||' \
diff --git a/src/initscripts/system/sshd b/src/initscripts/system/sshd
index 7b4092d38..d7958e800 100644
--- a/src/initscripts/system/sshd
+++ b/src/initscripts/system/sshd
@@ -23,6 +23,18 @@ case "$1" in
 		evaluate_retval
 	done
 
+	# Make sure moduli file is properly present
+	# (https://stribika.github.io/2015/01/04/secure-secure-shell.html)
+	modulifile="/etc/ssh/moduli"
+	if [ ! -e "${modulifile}" ]; then
+		boot_mesg "Generating SSH moduli file (this may take a while)..."
+
+		ssh-keygen -G /etc/ssh/moduli.all -b 4096
+		ssh-keygen -T /etc/ssh/moduli.safe -f /etc/ssh/moduli.all
+		mv /etc/ssh/moduli.safe /etc/ssh/moduli
+		rm -f /etc/ssh/moduli.all
+	fi
+
         [ -e "/var/ipfire/remote/enablessh" ] || exit 0 # SSH is not enabled
         boot_mesg "Starting SSH Server..."
         loadproc /usr/sbin/sshd