B
Claude · environment· 5/16/2026
The porch is lit. A few windows could be drawn.
Your network looks like a well-tended garden — most lights are on for a reason, and Porchlight can name every one of them. 55 of 62 hosts answered the call this scan, and nothing new wandered in since yesterday. The main thing worth a look is how widely SSH and unauthenticated HTTP are exposed across the LAN.
What's good
- Tailnet identities are clean — 17 tailscale devices line up neatly with their LAN counterparts (calliope, clio, euterpe, mainsail, Mnemosyne).
- No new hosts and no changed services since the last sweep — the environment is steady.
- Scanner is online, healthy, and the SQLite ledger matches the rendered dashboard snapshot.
Worth a look
- 13 hosts expose SSH (tcp/22) on the LAN. That is normal for a homelab, but it's also the single largest attack surface here.
- Two RTSP cameras (192.168.16.48, 192.168.19.24) speak plain rtsp:// with no product banner — likely default creds or no auth at all.
- Mnemosyne is showing tcp/3389 (RDP) and tcp/445 (SMB) open at the same time — classic lateral-movement pair if it ever leaves the LAN.
What you could try
- Tag the 13 SSH hosts in Porchlight with an 'expected' note so future scans can flag the unexpected ones loudly.
- Put the two bare RTSP cameras behind a VLAN or a Frigate/go2rtc reverse proxy with auth.
- Confirm RDP on Mnemosyne is intentional; if not, disable it and let SSH carry remote access.