Written 26 Aug 2026. This is a how-to, not a product card. Buy links are not tagged yet.

Change the leftover-box login password

Once SSH from the couch works, set a password you chose. Do this before you leave the install password sitting around.

You can already log in from the couch. Before you lean harder on that login, or turn on more services, replace the leftover-box password from install day with one you chose.

Skip until SSH works

If you cannot log in yet, stop. That is SSH from the couch. Fix that first. This note assumes you can type commands on the leftover box from the couch.

What this is

You are changing the leftover-box user password only. That is the password SSH asks for until you move to a key. Changing it does not change the Wi-Fi password. It does not change the router password. It is not the Pi-hole admin password, unless you set those the same on purpose. It is not the Samba share password. That is set or change the house-share password. The share itself is a file share on the leftover box.

Change it while logged in

SSH in the way SSH from the couch taught you. Then run:

passwd

It asks for the current password, then the new one twice. Nothing shows as you type. That is normal. Pick a password you chose, not the one from install day.

Open a second window before you leave

Keep the first SSH session open. Open a second SSH window and log in with the new password:

ssh you@that-address

Swap you and that-address the way SSH from the couch taught you. If the new password fails, you still have the old session open. Do not close the first window until the second login works.

What next

When password login has been boring for a bit, log in with a key, not the password every time. Later, turn off leftover-box password login once the key works. Do not open port 22 to the internet. SSH stays on the house network. That is keep the leftover box on the house network.

Skip

Skip this note if SSH from the couch does not work yet. That is SSH from the couch.
Skip changing the router password here.
Skip a password manager appliance.
Skip opening SSH to the internet.
Skip fail2ban on day one. Later is slow down password guesses on SSH.

Sources

Debian: passwd. Ubuntu: passwd. Official pages only. For the login, see SSH from the couch. When password login is boring, see log in with a key, not the password every time. Do not open port 22. That is keep the leftover box on the house network.

Also on this topic

SSH from the couchType commands on the leftover box from your laptop, on the house network. Password login first. Do not open this to the internet. Log in with a key, not the password every timeAfter password SSH works for a while, put a key on your laptop so the leftover box trusts that laptop. Keep the password as a backup at first. Turn off leftover-box password login once the key worksAfter the laptop key login is boring, tell SSH to stop accepting the leftover-box password. The key is how you get in. A keyboard on the leftover box is the backup now. Keep the leftover box on the house networkSSH and Pi-hole belong on the house network. Skip this if you never opened the router settings. Do not forward port 22.