Something to sincerely rethink is the idea of shutting the system down in the first place. Call the network provider & have them unplug the ethernet.

Turning the system off could potentially reduce your ability to audit where they originally got in. Anywhom.

SSH keys :)