Over a decade ago I worked for a CLEC. One day one of our engineers was on a support call with our client side TDM vendor, who had remoted into his computer to

Over a decade ago I worked for a CLEC. One day one of our engineers was on a support call with our client side TDM vendor, who had remoted into his computer to troubleshoot some issue. During that session the vendor's employee used a backdoor account to log in, and our engineer was recording his terminal session, so we had the password from there on out. We could not disable the account or change it's password, and it didn't show up as a logged in user when it was being used. So we made it a point to only turn on the SSH daemons on IP's that weren't available to the public. It did come in handy a few times to reset a real password when using a console cable was not feasible.