Written 28 Aug 2026. This is a how-to, not a product card. Buy links are not tagged yet.

See if anyone guessed the leftover-box password

Before you buy a camera or extra login software, peek at failed leftover-box logins with lastb.

You already peeked at who got in with see who logged into the leftover box recently, and who is on right now with see who is on the leftover box right now. Those lists are successful logins. This note is the other diary: password guesses that did not work. You are reading a short list the leftover box already keeps. You are not buying a camera, a SIEM, or extra login software for this look.

Skip until SSH works

If you have never logged in from the couch, that is SSH from the couch. Prefer a password you chose first: change the leftover-box login password. This note assumes you can log in from the couch. It is a quiet look, not day-one homework.

What this is

A peek, not a shopping trip. last is who got in. lastb is who did not: mistyped leftover-box passwords, and guesses that failed. Your own typos while learning SSH will show up. That is normal. Failed guesses that keep coming from outside the house are a different problem, and the fix is almost never a new gadget.

Ask who guessed and failed

SSH in from the couch, then ask. The leftover box will ask for your leftover-box password one more time, because this diary stays private:

sudo lastb -n 10

An empty print, or a line that says the diary is empty, is fine. A few lines with your username from a house address are usually you, mistyping. Do not buy anything because the table printed once. If it says permission denied, you skipped sudo.

Optional: show the source address

If the from column is truncated and you want the address:

sudo lastb -n 5 -a

Keep this note on the short list. You do not need a fancy log viewer for ten lines. If lastb is missing, the same diary is:

sudo last -f /var/log/btmp -n 10

If the list looks like the internet

A pile of names you did not type (root, admin, pi, ubuntu) from addresses that are not the house usually means SSH is reachable from the street. Stop. Close port 22 on the router. SSH stays on the house network: keep the leftover box on the house network. Change the leftover-box password: change the leftover-box login password. Do not buy a camera for a list of guesses. Do not install extra login software just because lastb printed. Guess-slowing later, after the firewall is on, is slow down password guesses on SSH.

What next

Leave it. Once in a while is enough for this peek after the login habit is boring. Successful history is see who logged into the leftover box recently. Who is on right now is see who is on the leftover box right now. The firewall path is turn on a simple firewall without locking yourself out. Guess-slowing later is slow down password guesses on SSH. The leftover-first rule stays start with what you already have.

Skip

Skip if SSH from the couch is not working yet. That is SSH from the couch.
Skip a camera, a SIEM, or extra login software for this look.
Skip opening port 22 on the router. SSH stays on the house network.
Skip treating your own mistyped leftover-box password as an attack.
Skip a NAS for this look.

Sources

Debian: lastb. Ubuntu: lastb. Official pages only. Successful logins are see who logged into the leftover box recently. Who is on right now is see who is on the leftover box right now. For the login, see SSH from the couch. For a password you chose, see change the leftover-box login password. For failed guesses later, see slow down password guesses on SSH. For the house-network boundary, see keep the leftover box on the house network.

Also on this topic

See who logged into the leftover box recentlyBefore you buy a camera or a monitoring box, peek at the leftover box login history with last. See who is on the leftover box right nowBefore you buy a camera or a monitoring box, ask who is logged into the leftover box right now with who. Change the leftover-box login passwordOnce SSH from the couch works, set a password you chose. Do this before you leave the install password sitting around. Log in with a key, not the password every timeAfter password SSH works for a while, put a key on your laptop so the leftover box trusts that laptop. Keep the password as a backup at first. Slow down password guesses on SSHAfter the firewall is on and key login is boring, you can let the leftover box briefly refuse an address that keeps guessing the leftover-box password. Skip this on day one. Do not forward port 22. Keep the leftover box on the house networkSSH and Pi-hole belong on the house network. Skip this if you never opened the router settings. Do not forward port 22. Turn on a simple firewall without locking yourself outAfter SSH from the couch works, allow OpenSSH, then turn on ufw. The leftover box stays reachable. Surprise inbound ports do not. SSH from the couchType commands on the leftover box from your laptop, on the house network. Password login first. Do not open this to the internet.