====== Find ssh Backdoor ======
==== 9 Ways to backdoor a Linux Box ====
https://airman604.medium.com/9-ways-to-backdoor-a-linux-box-f5f83bae5a3c
==== Find suspicious authorized_keys File ====
<code>
find / -name authorized_keys 2>/dev/null
/root/.ssh/authorized_keys
/boot/grub/.ssh/authorized_keys
/home/student/.ssh/authorized_keys
/home/rfadmin/.ssh/authorized_keys
/etc/skel/.ssh/authorized_keys
</code>

==== Remove it ====
<code>
rm /boot/grub/.ssh/authorized_keys
</code>