Install one.

Depending on how likely you think that it is that he would try to do something, take some of the most obvious user names and passwords he might use, and leave it enabled in a chroot jail, and be sure to log it for any activity. In the same spirit, turn on any process accounting options that seem like a fit, and track them for suspicious activity.

If he does try something, that will at least give you a good chance to catch him early, before he has done nearly the damage he could do...

Cheers,
Ben