Written 30 Aug 2026. This is a how-to, not a product card. Buy links are not tagged yet.

Check a leftover-box file fingerprint

After SSH works, check a leftover-box file with sha256sum so you know the file you pulled still matches the fingerprint you expected. You do not need a download manager for this.

Download a file onto the leftover box put one practice file in leftover-box home. Tonight you only need one more trick: ask the leftover box for a fingerprint of that file. sha256sum does that. A fingerprint is a long fixed-looking string made from the file bytes. Change one byte and you get a different string. You are still only practicing. The leftover box does not need a download manager, a new mini PC, or paid checksum software for this one job.

Skip until SSH already works

SSH from the couch should already get you a leftover-box prompt. Prefer a practice file from download a file onto the leftover box (~/example.html). If you only need to pull the file, that is curl. If you only need a file from your laptop, that is copy a file to the leftover box from your laptop. If you only need to compare two leftover-box files side by side, that is see whether two leftover-box files are the same. If you only need a word search, that is find a word in a leftover-box file. Skip this whole note if you only need a house share other computers browse. That is a folder the house can open.

What this is

sha256sum means "print a fingerprint of this file." You type sha256sum, then a path in leftover-box home. The leftover box prints a long hex string, then the filename. Hex means digits and letters a–f. That string is the fingerprint. Same bytes → same fingerprint. Change one byte → new fingerprint. It is not a download. That is download a file onto the leftover box. It is not a copy from your laptop. That is copy a file to the leftover box from your laptop. It is not comparing two leftover-box files line by line. That is see whether two leftover-box files are the same. It is not searching for a word. That is find a word in a leftover-box file. It is not dumping the file text. That is read a leftover-box file without opening the editor. It is not wrapping leftover-box long lines. That is wrap leftover-box long lines. It is not leftover-box line numbers. That is number leftover-box lines.

Fingerprint one practice file in leftover-box home

SSH in. Make sure leftover-box home is where you are sitting:

pwd

You want a path that ends in your login name. Prefer the practice page from curl:

ls -lh ~/example.html

If that file is missing, make a tiny leftover-box practice file instead:

printf 'hello leftover box\n' > ~/check-me.txt

Now ask for the fingerprint:

sha256sum ~/example.html

Or, if you made the tiny file:

sha256sum ~/check-me.txt

You want one long hex string, a space or two, then the filename. That string is the fingerprint. Copy it somewhere safe if a download page later shows an expected fingerprint. On night one you only need to see that the leftover box can print one.

Run the same command again without changing the file. You want the same fingerprint. Same bytes → same string.

Useful extras, still looking only

Want to watch the fingerprint change after you rewrite the file?

printf 'hello leftover box\nchanged\n' > ~/check-me.txt

sha256sum ~/check-me.txt

You want a different long hex string. One byte change is enough. That is the whole point of a fingerprint.

Optional: save an expected fingerprint and check it. First write a line in the format sha256sum printed (hash, two spaces, path), then:

sha256sum ~/check-me.txt > ~/check-me.sha256

sha256sum -c ~/check-me.sha256

You want a line that ends in OK. -c means "check the fingerprints listed in this file." Keep that file in home on night one.

Skip md5sum as tonight's primary tool. MD5 is an older, weaker fingerprint style. Tonight's tool is sha256sum.

Skip openssl dgst as tonight's lesson. Some leftover boxes have OpenSSL. Tonight you only need the plain coreutils command.

If the leftover box says command not found for sha256sum, install coreutils, then try again:

sudo apt install coreutils

Debian and Ubuntu Server usually already have it. That install is not a reason to buy checksum software.

When you are done looking, throw away the leftover-box practice files:

rm ~/check-me.txt ~/check-me.sha256

Keep ~/example.html if you still want it from curl, or delete that one the same way. Careful delete only. That is delete a leftover-box file carefully.

What this is not

This is not a download. That is download a file onto the leftover box. It is not a copy from your laptop. That is copy a file to the leftover box from your laptop. It is not comparing two leftover-box files line by line. That is see whether two leftover-box files are the same. It is not a word search. That is find a word in a leftover-box file. It is not a short dump of a leftover-box file. That is read a leftover-box file without opening the editor. It is not wrapping leftover-box long lines. That is wrap leftover-box long lines. It is not leftover-box line numbers. That is number leftover-box lines. It is not leftover-box file size, date, and permissions. That is see leftover-box file size, date, and permissions. It is not a house share other computers browse. That is a folder the house can open. It is not opening SSH to the internet so you can check downloads from a coffee shop. That is keep the leftover box on the house network.

What next

Need the practice file first? Download a file onto the leftover box. Need a file from your laptop instead? Copy a file to the leftover box from your laptop. Need to compare two leftover-box files side by side? See whether two leftover-box files are the same. Need a short dump of the file? Read a leftover-box file without opening the editor. Need leftover-box long lines wrapped? Wrap leftover-box long lines. Need leftover-box line numbers? Number leftover-box lines. Need to prove the leftover box can reach past the router first? Check that the leftover box can reach the internet. Need the throwaway gone for real? Delete a leftover-box file carefully. Need leftover-box file size, date, and permissions without opening the leftover-box file? See leftover-box file size, date, and permissions. When a house job broke, look at the leftover box's own diary: when something broke, look at the leftover-box log. When key login is boring on every computer you use, turn off leftover-box password login once the key works. Keep SSH on the house network: keep the leftover box on the house network. Do not forward port 22.

Skip

• Skip if SSH still fails. Finish SSH from the couch first.
• Skip fingerprinting files under /etc, SSH folders, or paths you do not own. Practice only in home.
• Skip piping fingerprints into rm or other deletes. Tonight you only print or check a fingerprint.
• Skip openssl as tonight's lesson, and skip treating md5sum as the primary check. Prefer sha256sum.
• Skip huge OS images on night one. Practice one small leftover-box home file first.
• Skip buying checksum software. Debian and Ubuntu already ship sha256sum with coreutils.
• Skip opening SSH to the internet so you can verify downloads from a coffee shop. That is keep the leftover box on the house network. Do not forward port 22.