Written 25 Aug 2026. This is a how-to, not a product card. Buy links are not tagged yet.

Log in with a key, not the password every time

After password SSH works for a while, put a key on your laptop so the leftover box trusts that laptop. Keep the password as a backup at first.

Password login from SSH from the couch should already be boring. A key is a small file on your laptop that proves it is you. You type a passphrase once, or not, instead of the leftover-box password every time.

Skip until password SSH is boring

If SSH from the couch still prints Permission denied, or the leftover-box password is still wrong some days, stop. Fix that first. A key will not help a login that does not work yet.

What a key is

You make two files. The public key goes on the leftover box. The private key stays on your laptop. The leftover box checks the public file and lets that laptop in. Never email the private key. Never copy it onto a stick you will lose. This is not a new router. The house number stays the same. The leftover-box password can still work as a backup.

Make a key on your laptop

On Windows, use Windows Terminal or PowerShell. On a Mac or Linux, use Terminal. Same command:

ssh-keygen -t ed25519 -C "laptop"

Accept the default path when it asks. A passphrase on the key is optional. A short one is still better than none, so a stolen laptop file is not a free login. If you skip the passphrase, press Enter at that prompt. It writes two files under .ssh in your home folder. One ends in .pub. That is the public key.

Copy the public key to the leftover box

Use the leftover-box username and the number from find the leftover box on the house network. A reservation so that number stays put is keep the leftover box on the same number. Prefer this command, which asks for the leftover-box password one last time:

ssh-copy-id you@that-address

Swap you and that-address the way SSH from the couch taught you.

If ssh-copy-id is missing, which happens on some Windows setups, SSH in with the leftover-box password. On the leftover box, append the public line, the whole contents of the laptop file that ends in .pub, to ~/.ssh/authorized_keys. Do not paste the private file. Then:

chmod 700 ~/.ssh

chmod 600 ~/.ssh/authorized_keys

Try it

From the same laptop:

ssh you@that-address

It should not ask for the leftover-box password. It may ask for the key passphrase, if you set one. You should see the leftover-box prompt, the same as SSH from the couch.

If it still asks for the leftover-box password, the public line is not on that user, or you pasted the wrong file. Check you used the leftover-box username, the same number, and the .pub file, not the private one. Run ssh-copy-id again. Do not start editing server config yet.

Keep password login for now

Leave password login on. Do not turn off PasswordAuthentication. That is a later harden note. If the laptop dies, the leftover-box password is how you get back in from another computer. Keep it as a backup.

What next

Once a week, keep the leftover box updated. If Pi-hole is not up yet, that is the first useful thing on the leftover box. Do not forward port 22. SSH stays on the house network. That is keep the leftover box on the house network.

Skip

• Skip this note if password SSH is still flaky.
• Skip buying a YubiKey for a leftover box.
• Skip fail2ban.
• Skip a new firewall appliance.
• Skip opening the leftover box to the internet.