# Persistence

> Guides on maintaining SSH access after initial compromise

- **URL:** https://hackindex.io/services/ssh/persistence
- **Service:** [SSH](https://hackindex.io/services/ssh.md)
- **Tags:** foothold, resilience
- **Published:** 2026-05-06
- **Updated:** 2026-05-06

SSH persistence ensures you keep access even when credentials rotate or the initial entry point gets patched. Authorized_keys injection is the most straightforward technique: add your public key to a user's ~/.ssh/authorized_keys file and you have password-independent access that survives credential changes. Place it on service accounts that rarely get audited.

Config-based backdoors modify sshd_config or drop a second sshd instance on a non-standard port with permissive authentication settings. A hidden SSHD listening on a high port with its own host keys and authorized_keys is harder to detect than modifying the primary service. SSH certificates issued from a compromised CA key grant access to any host that trusts that CA, potentially for the certificate's entire validity period.

For subtlety, add your key to a user who already has dozens of authorized keys, or modify ~/.ssh/config on the target to route connections through your infrastructure. Combine persistence with tunneling so the backdoor is accessible even from outside the network.

## Guides

- [SSH Persistence Techniques](https://hackindex.io/services/ssh/persistence/ssh-persistence.md): Explores SSH-based persistence methods including authorized_keys manipulation, config backdoors, and rogue SSH daemons to maintain long-term access.