Written 28 Aug 2026. This is a how-to, not a product card. Buy links are not tagged yet.

Unlock your leftover-box key once per laptop session

After the key has a passphrase, load it once with ssh-add so you are not typing that passphrase on every ssh leftover. You do not need a YubiKey.

Log in with a key put a passphrase on the private key so a stolen laptop file is not a free login. That is good. It also means every new SSH asks for that passphrase again. The agent is a small program on the laptop that remembers the unlocked key for this login session. The leftover box does not change. This is laptop-side only.

Skip until the key login already works

Log in with a key should already get you in. If you never set a passphrase on the key, you can skip this whole note. A short name is nicer when you try it: give the leftover box a short name on your laptop. Prefer a second computer before you harden password SSH: put a leftover-box key on a second computer first.

What this is

OpenSSH on your laptop can talk to an agent. You unlock the private key once. Later SSH and scp reuse that unlock until you log out of the laptop, reboot, or clear the agent. The leftover box still sees a normal key login. It never sees your passphrase.

See if an agent is already running

On the laptop (Windows Terminal, PowerShell, Mac Terminal, or Linux):

echo "$SSH_AUTH_SOCK"

If that prints a path, an agent is already available in this terminal. On many Mac and Linux desktops it starts with your login. If the line is empty, start one for this terminal:

eval "$(ssh-agent -s)"

You should see a line about Agent pid. That only lasts for this terminal until you open a new one, unless your desktop already keeps an agent for every window.

Load the key once

Default path from log in with a key:

ssh-add ~/.ssh/id_ed25519

Type the key passphrase when it asks. Optional check that it loaded:

ssh-add -l

You want one line that mentions ED25519 and your comment, like laptop or second-laptop. If it says The agent has no identities, run ssh-add again with the private file path, not the .pub file.

Try it

From the same laptop:

ssh leftover

Or the long form if you have no short name yet:

ssh you@that-address

It should not ask for the key passphrase again in this session. It may still ask if the agent never loaded, or if this terminal is not talking to the same agent. Open a second terminal and try once more. If the second window asks again, that window has no agent yet. Run the eval and ssh-add steps there, or use a desktop that shares one agent across windows.

Optional: remember the key in your SSH config

If you already have a short name from give the leftover box a short name on your laptop, you can add one line under that Host block so a future login offers the key to the agent:

Host leftover
  HostName that-address
  User you
  AddKeysToAgent yes
  IdentityFile ~/.ssh/id_ed25519

The first SSH after a reboot may still ask for the passphrase once. Later ones in that session should stay quiet. This does not turn off the leftover-box password. That harden step is later.

What next

Need one file over without a USB stick? Copy a file to the leftover box from your laptop. When both computers get in without the leftover-box password, turn off leftover-box password login once the key works. Keep a keyboard on the leftover box as the last backup. Keep SSH on the house network: keep the leftover box on the house network. Do not forward port 22.

Skip

• Skip if the key has no passphrase. There is nothing to unlock.
• Skip if key login is still flaky. Finish log in with a key first.
• Skip a YubiKey for a leftover box.
• Skip copying the private key to a USB stick so you never type a passphrase.
• Skip opening SSH to the internet. That is keep the leftover box on the house network.