Or more importantly, once in they insert a public key in there so if you naively disable password access they'll still be able to get back in. Change the passwo

Or more importantly, once in they insert a public key in there so if you naively disable password access they'll still be able to get back in. Change the password AND remove any keys in ~/.ssh. Also a debsums or rpm -qV is a good idea. A complete re-install is my preferred method though.