Find ssh Backdoor

Find suspicious authorized_keys File

find / -name authorized_keys 2>/dev/null
/root/.ssh/authorized_keys
/boot/grub/.ssh/authorized_keys
/home/student/.ssh/authorized_keys
/home/rfadmin/.ssh/authorized_keys
/etc/skel/.ssh/authorized_keys

Remove it

rm /boot/grub/.ssh/authorized_keys