Find ssh Backdoor

9 Ways to backdoor a Linux Box

https://airman604.medium.com/9-ways-to-backdoor-a-linux-box-f5f83bae5a3c

Find suspicious authorized_keys File

find / -name authorized_keys 2>/dev/null
/root/.ssh/authorized_keys
/boot/grub/.ssh/authorized_keys
/home/student/.ssh/authorized_keys
/home/rfadmin/.ssh/authorized_keys
/etc/skel/.ssh/authorized_keys

Remove it

rm /boot/grub/.ssh/authorized_keys