Written 28 Aug 2026. This is a how-to, not a product card. Buy links are not tagged yet.

See which laptop keys the leftover box already trusts

Before you turn off password login, look at which laptop keys can already get into the leftover box. Remove leftovers from an old Marketplace box. You do not need a YubiKey for this.

Log in with a key puts your laptop's public line on the leftover box. This note is the look after that: open the list and see who else is already trusted. A Marketplace leftover can still hold an old owner's key. That is not a reason to buy a camera or a YubiKey. It is a reason to look once.

Skip until a key login works

If password SSH is still the only way in, stop. Put a key on first: log in with a key, not the password every time. If you cannot log in from the couch, that is SSH from the couch. Prefer this look after you know who else can still log in with a password: see if the leftover box still has old login accounts. This note assumes you can open a shell as your everyday leftover-box user.

What this file is

Each line in ~/.ssh/authorized_keys is one laptop (or phone, or other computer) the leftover box will let in without the leftover-box password. Your line from log in with a key should be there. Extra lines you do not recognize are the problem. This is not the laptop's private key. It is the public half the leftover box remembers.

See if the file exists

From the leftover box (SSH or the keyboard):

ls -la ~/.ssh/

You want a file named authorized_keys. If the folder is missing, or that file is missing, you have not finished the key note yet. Go back to log in with a key. Optional count of lines:

test -f ~/.ssh/authorized_keys && wc -l < ~/.ssh/authorized_keys || echo no keys file yet

One line is normal after one laptop. Zero means the file is empty. More than one means more than one key is trusted. That can be fine (your laptop plus a second computer). It can also be an old Marketplace key.

Read the list

cat ~/.ssh/authorized_keys

Each line starts with ssh-ed25519 or ssh-rsa, then a long blob, then often a short comment (an email or a laptop name). That comment is a hint, not a password. Match the comment to a laptop you own. A comment you do not recognize, or a second long blob you never pasted, is a leftover to remove before you harden login.

Remove a line you do not trust

Keep one SSH window open so you do not lock yourself out. Open the file in a simple editor:

nano ~/.ssh/authorized_keys

Delete only the full line you do not trust. Save and quit (in nano: Ctrl+O, Enter, then Ctrl+X). Do not delete your own laptop's line. Then prove your key still works from a second terminal:

ssh you@that-address

Swap you and that-address the way SSH from the couch taught you. If that works, you are done with the cleanup. Skip buying login software for this look.

Optional: check root too

Most leftover Debian and Ubuntu installs do not let root SSH in. If you ever enabled that, peek:

sudo test -f /root/.ssh/authorized_keys && sudo wc -l < /root/.ssh/authorized_keys || echo no root keys file

If that prints a number, read it the same way with sudo cat /root/.ssh/authorized_keys. Empty or missing is the usual win. Skip this optional look if you never logged in as root over SSH.

What next

Once the list is only keys you trust, give the leftover box a short name on your laptop, then put a leftover-box key on a second computer first. When both computers get in, turn off leftover-box password login once the key works. Keep a keyboard on the leftover box as the backup. Then see which doors are open: see which doors the leftover box left open. Skip a YubiKey. Skip forwarding port 22.

Skip

Skip if key login is not working yet. Finish log in with a key first.
Skip a YubiKey for a leftover box.
Skip buying a camera or extra login software for this look.
Skip turning off password login until this list is only keys you trust. That harden step is turn off leftover-box password login once the key works.
Skip opening SSH to the internet. That is keep the leftover box on the house network.

Sources

OpenSSH: sshd (AUTHORIZED_KEYS FILE FORMAT). Debian: sshd. Debian: ssh-keygen. Ubuntu: OpenSSH server. Official pages only. For putting your key on, see log in with a key. For old password accounts, see see if the leftover box still has old login accounts. For a second computer, see put a leftover-box key on a second computer first. For turning off password SSH after this look, see turn off leftover-box password login once the key works.

Also on this topic

Log in with a key, not the password every timeAfter password SSH works for a while, put a key on your laptop so the leftover box trusts that laptop. Keep the password as a backup at first. Put a leftover-box key on a second computer firstBefore you turn off password login, give a second laptop its own leftover-box key so you are not locked out if the first one dies. You do not need a YubiKey. Turn off leftover-box password login once the key worksAfter the laptop key login is boring, tell SSH to stop accepting the leftover-box password. The key is how you get in. A keyboard on the leftover box is the backup now. See if the leftover box still has old login accountsBefore you leave a Marketplace box on the house network, look at who else can still log in. You do not need extra login software for this. When SSH says the leftover box looks differentAfter you reinstall, SSH can refuse because your laptop still remembers the old leftover-box ID. Clear that memory. You do not need a new router. SSH from the couchType commands on the leftover box from your laptop, on the house network. Password login first. Do not open this to the internet.