Feels good to run nmap from inside the network and still get over 60K blocked connections in portmaster. The network may not be perfect but at least the machines on it are locked down. Now I just gotta monitor for intrusions and watch for that rootkit I had.
Also speaking of, I apologize profusely to anyone who was receiving spam from any of my domains or from my IP with a spoofed domain. I had a rootkit which is primarily used for creating spam botnets and running DDOS attacks. It has since been cleaned from the system. While I’m not 100% sure of the source, if I had to guess I got hit with some of that AUR malware that’s been floating around. I guess that will teach me to actually read the fucking makepkg. It’s silly, I remember seeing the sketchy piece of code (barebones basic obfuscation using sed and some escape characters, literally still readable with a tiny bit of effort) in a makepkg but for whatever reason it didn’t occur to me to trust those alarm bells.
(I made this a mastodon post at first and wordpress decided not to federate it out to bsky or hit my RSS feeds with it, I’m reposting it now)