Let's say I hire someone (freelance), for IT work on an Ubuntu server. The server has a good firewall, I run clamav, chkrootkit & rkhunter scans weekly, and I try to keep good practices.
The thing is, if I suspect that he installed some backdoor on the machine, how would you search for it? He had root access and plenty of time, so...
I know this theme has been discussed earlier, but most were theoretical rather than practical answers.
NOTE: This is on a remote server, so I'm not able to do hardware-based analysis.