Persistence

SSH persistence ensures you keep access even when credentials rotate or the initial entry point gets patched. Authorized_keys injection is the most straightforward technique: add your public key to a user's ~/.ssh/authorized_keys file and you have password-independent access that survives credential changes. Place it on service accounts that rarely get audited.

Config-based backdoors modify sshd_config or drop a second sshd instance on a non-standard port with permissive authentication settings. A hidden SSHD listening on a high port with its own host keys and authorized_keys is harder to detect than modifying the primary service. SSH certificates issued from a compromised CA key grant access to any host that trusts that CA, potentially for the certificate's entire validity period.

For subtlety, add your key to a user who already has dozens of authorized keys, or modify ~/.ssh/config on the target to route connections through your infrastructure. Combine persistence with tunneling so the backdoor is accessible even from outside the network.