Written 9 Sep 2026. This is a how-to, not a product card.

A camera can wait

last and who are enough. Don't buy a camera for leftover-box SSH.

Peek at recent logins: see who logged into the computer recently. Who is on right now: see who is on the computer right now. Failed guesses: see if anyone guessed the password. A Wyze, a doorbell cam, or a SIEM does not make those three looks more true. Keep SSH on the house network: keep the computer on the house network.

When a camera is later

Come back to a camera only after you understand the list, port 22 is not forwarded, and you still want a picture of a door — not because last printed once. fail2ban still waits: fail2ban can wait. A monitor still waits: a monitor can wait.

What next

Weekend path: SSH from the couch. Tick Lab plan after your own couch line is the only one you recognize. Don't punch a hole: NAT is why SSH stays inside.

Optional: last / who as a sandbox in ByteRush — same Labthrift passkey as Plan. Skip if you just want to keep reading.

Skip

Skip a camera, a doorbell cam, and a SIEM for leftover-box SSH this weekend.
Skip treating your own couch SSH line as an attack.
Skip forwarding port 22 so a camera has something to watch.

Sources

Peek: last. Live: who. Guesses: lastb. Lessons: ByteRush.

Also on this topic

See who logged in recentlylast is a peek. You don't need a camera for this. See who is on right nowwho is the live room. A SIEM waits. See if anyone guessed the passwordlastb. Close port 22. Don't buy a camera for a list.