During a Linux post-exploitation phase, a penetration tester gains root access to a web server through a kernel exploit. The tester wants to maintain reliable access that survives reboots and does not depend on the current vulnerable process, while blending in with normal administrative activity. The server exposes SSH to a management VLAN the tester can reach through an established pivot. Which persistence technique BEST meets these requirements?