Written 28 Aug 2026. This is a how-to, not a product card. Buy links are not tagged yet.

Put a leftover-box key on a second computer first

Before you turn off password login, give a second laptop its own leftover-box key so you are not locked out if the first one dies. You do not need a YubiKey.

Log in with a key put a key on one laptop. Turn off leftover-box password login then stops the leftover-box password at SSH. If that one laptop dies, the leftover-box password is no longer a way in from the house. A second key is a second computer the leftover box already trusts. This is not a copy of the first private key. Make a new key on the second computer. A keyboard on the leftover box is still the last backup.

Skip until the first key login is boring

Log in with a key should already work from the first laptop. Prefer one look at the list first: see which laptop keys the leftover box already trusts. A short name is nicer on the second laptop too: give the leftover box a short name on your laptop. Skip this whole note if you only have one computer and you keep a keyboard on the leftover box. Skip buying a second laptop just for this.

What this is

You make a new key pair on computer two. The public line goes on the leftover box. The leftover box then trusts two computers. Do not copy the private key from laptop one. Do not email it. Do not put it on a USB stick. Each computer gets its own key. If one laptop is lost, you remove that one public line later. The other computer still gets in.

Make a key on the second computer

On the second laptop (Windows Terminal, PowerShell, Mac Terminal, or Linux), same command as the first key:

ssh-keygen -t ed25519 -C "second-laptop"

Accept the default path when it asks. A passphrase on the key is optional. A short one is still better than none, so a stolen laptop file is not a free login. If you skip the passphrase, press Enter at that prompt. It writes two files under .ssh in that computer's home folder. One ends in .pub. That is the public key.

Copy the public key

From the second computer, prefer this. It asks for the leftover-box password one last time, unless that computer already has a key:

ssh-copy-id you@that-address

Swap you and that-address the way SSH from the couch taught you. If this second laptop already has a short name, ssh-copy-id leftover works the same. That short name is give the leftover box a short name on your laptop, done again on this computer.

If ssh-copy-id is missing, SSH in with the leftover-box password. On the leftover box, append the public line, the whole contents of the second-laptop file that ends in .pub, to ~/.ssh/authorized_keys. Do not paste the private file. Then:

chmod 700 ~/.ssh

chmod 600 ~/.ssh/authorized_keys

Try it

From the second computer:

ssh leftover

Or the long form, if this laptop has no short name yet:

ssh you@that-address

It should not ask for the leftover-box password. It may ask for the key passphrase, if you set one. You should see the leftover-box prompt. Then, from the first laptop, log in the same way. That key should still work. If the second computer still asks for the leftover-box password, the public line is not on that user, or you pasted the wrong file. Check you used the leftover-box username, the same number, and the .pub file, not the private one. Run ssh-copy-id again.

Look at the list

On the leftover box, you should now see two public lines. That look is see which laptop keys the leftover box already trusts:

cat ~/.ssh/authorized_keys

You want two lines that start with ssh-ed25519, one tagged laptop and one tagged second-laptop if you used those comments. Optional count:

wc -l < ~/.ssh/authorized_keys

Two is the usual win after this note. More than that is fine if you already added a third computer. A line you do not recognize is leftover from a Marketplace box. Remove that one the way the trusted-key note taught you.

What next

If the key has a passphrase, unlock your leftover-box key once per laptop session so you are not typing it on every login. When both computers get in without the leftover-box password, turn off leftover-box password login once the key works. Keep a keyboard on the leftover box as the last backup. Keep SSH on the house network: keep the leftover box on the house network. Do not forward port 22.

Skip

• Skip if the first key login is still flaky. Finish log in with a key first.
• Skip buying a second laptop just for this. Use a computer you already have, or keep a leftover-box keyboard.
• Skip copying the private key from laptop one. Make a new key on computer two.
• Skip a YubiKey for a leftover box.
• Skip opening SSH to the internet. That is keep the leftover box on the house network.