Heralding
Heralding is a free, self-hosted network honeypot for collecting credentials.
What Heralding is
Heralding is a free, self-hosted network honeypot for collecting credentials. It runs on Linux and supports FTP, Telnet, SSH, HTTP, HTTPS, POP3, POP3S, IMAP, IMAPS, SMTP, VNC, PostgreSQL, and SOCKS5. Its authentication log records usernames and plaintext passwords when the protocol makes them available. Heralding also writes authentication attempts, session summaries, and complete session data to CSV and JSON Lines files. Session information can include timestamps, duration, source and destination IP addresses and ports, protocol, authentication attempts, and protocol-specific auxiliary data. Session log entries are written after sessions end, while authentication entries appear when a password has been transmitted. The README describes pip installation on Debian-based systems and Docker deployment with port mapping. It requires Python 3.7.0 or higher. The README also points to Curisoum for separate packet captures per session and says to enable it in Heralding.yml. GitHub identifies the project as GPL-3.0 licensed.
Good
- Supports a broad list of network protocols
- Writes session data to CSV and JSON Lines
- Offers pip and Docker deployment guidance
- Free and GPL-3.0 licensed
Watch out
- Requires Python 3.7.0 or higher
- Session logs are written after a session ends
- Plaintext password capture depends on protocol availability
Who it suits
Heralding suits users who want to collect credentials with a self-hosted Linux honeypot. It may also suit users who need authentication and session details saved to CSV or JSON Lines files.
Verdict
Heralding records credential attempts and session details across many protocols, with pip and Docker deployment guidance. Account for its Python requirement and the fact that session logs arrive after sessions end.
Plans and prices
From Heralding's own pricing page, checked 3 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Heralding | Free | GPL-3.0 licensed open-source honeypot |
The facts
Each one read from Heralding's own pages, with the date it was checked.
What it does
- Authentication capture
- The auth log records usernames and plaintext passwords when the protocol makes them available.checked 3 Oct 2026
- Container deployment
- The project README describes building a Docker image and running it with a port mapping.checked 3 Oct 2026
- Installation
- The README gives pip installation instructions and describes running Heralding on a Debian-based system.checked 3 Oct 2026
- Intended users
- The project describes itself as a honeypot for users who want to collect credentials.checked 3 Oct 2026
- License
- GitHub identifies the project as GPL-3.0 licensed.checked 3 Oct 2026
- Log timing
- Session log entries are written after a session ends, while auth log entries appear when a password has been transmitted.checked 3 Oct 2026
- Packet capture
- The README points to Curisoum for creating a separate PCAP for each Heralding session and says to enable it in Heralding.yml.checked 3 Oct 2026
- Protocols
- It supports FTP, Telnet, SSH, HTTP, HTTPS, POP3, POP3S, IMAP, IMAPS, SMTP, VNC, PostgreSQL and SOCKS5.checked 3 Oct 2026
- Purpose
- Heralding is a simple honeypot that collects credentials.checked 3 Oct 2026
- Requirements
- The README states that Python 3.7.0 or higher is required.checked 3 Oct 2026
- Session details
- Session data can include timestamps, duration, source and destination IP and port, protocol, authentication attempts and protocol-specific auxiliary data.checked 3 Oct 2026
- Session logs
- It writes authentication attempts, session summaries and complete session data to CSV and JSON Lines files.checked 3 Oct 2026
Alternatives to Heralding
- 1
Canarytokens
Free planAndroidiOSWebSelf-hosted6.6Free plan - 2
OpenCanary
Free planLinuxmacOSSelf-hosted6.5Free plan - 3
Honeytrap
Free planLinuxSelf-hosted6.2Free plan - 4
KFSensor
Windows6.2From $120 a year - 5
Thinkst Canary
WebAPILinuxmacOS6.2From $7,500 a year - 6
Honeyd
Free planLinuxSelf-hostedWindows6.0Free plan