How to control remote admin?

Question

Debian

You need to put a freelance admin on the server, and there is a commercial product.
How to make sure that the admin did not leave backdoors and did not replenish his account in the system?
history can be cleaned
up git can hide the file via .gitignore
find . -mtime you can change the modification time of the file

Answer 1

Probably the safest option is to hire a normal admin for a permanent job.

Answer 2

As an option, duplicate the console, and write everything to the log.
I don't remember how it was on Debian. On FreeBSD there is such a tool called watch
Here is an example description: kp-room.ru/page/freebsd-watch.html
In fact, this allows you to spy on another console. An uninformed person is unlikely to guess that you are following him.
There was also something similar on Debian, but I don’t remember the name

Answer 3

Log every breath to a third-party service

Answer 4

Yes, in fact, nothing, having root fields, you can confuse everything so much that it will be practically impossible to find it.
You can just dd to disk and there will be nothing.

Answer 5

https://debian.pro/1149
https://debian.pro/1142
Of course, look in Realtime, if it tries to bypass snoopy - throw it out of the system.