Written 28 Aug 2026. This is a how-to, not a product card. Buy links are not tagged yet.

See who logged into the leftover box recently

Before you buy a camera or a monitoring box, peek at the leftover box login history with last.

SSH from the couch works. You changed the leftover-box password. Maybe a key login is already boring. Once in a while, ask who has been getting in. You are reading a short history the leftover box already keeps. You are not buying a camera, a SIEM, or a monitoring appliance for this look.

Skip until SSH works

If you have never logged in from the couch, that is SSH from the couch. Prefer a password you chose first: change the leftover-box login password. This note assumes you can log in from the couch. It is a quiet look, not day-one homework.

What this is

A peek, not a shopping trip. last prints recent logins from the leftover box diary (who, when, from where on the house network). Your own SSH sessions will show up. That is normal. You are checking that the list looks like you, not a stranger. Failed password guesses are a different peek: see if anyone guessed the leftover-box password.

Ask who logged in

SSH in from the couch, then ask:

last -n 10

You should see a short table. Your username, pts/ or similar for SSH, a time, and often a house address or hostname. Empty or only your lines is fine. Do not buy anything because the table printed once.

Optional: show the source address

If the from column is truncated and you want the address:

last -n 5 -a

Keep this note on the short list. You do not need a fancy log viewer for ten lines.

If a line looks wrong

Stop. Change the leftover-box password again: change the leftover-box login password. Prefer a key, then turn password login off when the key is boring: log in with a key, not the password every time, then turn off leftover-box password login once the key works. Keep SSH on the house network only: keep the leftover box on the house network. Do not forward port 22. Do not buy a camera for one odd line until you understand the list.

What next

Leave it. Once a week is enough for this peek after the login habit is boring. For who is on right now, see see who is on the leftover box right now. The firewall path is turn on a simple firewall without locking yourself out. Failed guesses are see if anyone guessed the leftover-box password. Guess-slowing later is slow down password guesses on SSH. The leftover-first rule stays start with what you already have.

Skip

• Skip if SSH from the couch is not working yet. That is SSH from the couch.
• Skip a camera, a SIEM, or a monitoring box for this look.
• Skip opening port 22 on the router. SSH stays on the house network.
• Skip treating your own recent SSH lines as an attack.
• Skip a NAS for this look.