OpenCanary

OpenCanary is a self-hosted honeypot that waits for intruders to engage with decoy network services. It suits defenders who can manage their own host and alert pipeline; its wide protocol selection costs nothing, but Linux is the strongest fit and configuration permissions demand care.

Overview

Run as a daemon, OpenCanary mimics network-accessible services and alerts when someone interacts with them. Its native decoys span SSH, FTP, Git, web and database services, Telnet, SNMP, SIP, VNC, Redis, TFTP, NTP and TCP banners. Alerts can identify a source IP and indicate where a breach may have occurred, giving operators useful leads for investigation—not a substitute for broader monitoring.

Its very low resource needs make it feasible to run on a Raspberry Pi or a minimally resourced virtual machine. The software is BSD-licensed and maintained by Thinkst Canary as the open-source counterpart to its commercial honeypot.

Key features

Alert destinations include files, Syslog, SMTP email, HTTP webhooks, Slack, Microsoft Teams and HPFeeds-compatible daemons. The customizable webhook handler supports GET, POST and PUT, which gives teams flexibility to route event data to an HTTP endpoint. The companion opencanary-correlator can combine related events—such as separate brute-force login attempts—into a single email or SMS alert, reducing the noise of one message per attempt.

Optional modules broaden the picture: SMB monitoring watches Samba logs for files opened in a Windows file share, while portscan monitoring uses iptables to detect scans. These add-ons come with dependencies and platform restrictions, so they are not equally useful in every deployment.

Pricing

The OpenCanary plan costs nothing and includes open-source software for self-hosted deployment. There is no software charge, but operators provide and manage the host and its network configuration. This fits teams comfortable running their own honeypot; it is not a hosted service.

Platforms

OpenCanary supports Linux and macOS, with self-hosted deployment and Docker deployment on Linux hosts using host networking. Linux offers the broadest options: SMB monitoring is unavailable on macOS, and portscan monitoring is Linux-only because it modifies iptables rules rather than nftables. Portscan is automatically disabled in Dockerized OpenCanary. The optional SNMP module requires Scapy, and the Windows File Share module requires Samba.

Security configuration matters because the program reads its configuration while running with root privileges. The project recommends making that file root-owned and writable only by root; a writable configuration can enable privilege escalation. When started with uid and gid flags, OpenCanary drops root privileges after binding to its ports.

Who it's for

OpenCanary is a good match for security teams and technically capable administrators who want several network-service decoys on modest infrastructure and can manage alert delivery themselves. Its source-IP context and event correlation help make interactions actionable. Choose another approach if you need a managed deployment or cannot accommodate its host-specific limitations and security setup.

Pros and cons

• Pros: Broad native protocol coverage and multiple alert destinations give defenders room to tailor decoys and routing without a software fee.
• Pros: Low resource requirements make deployment on a Raspberry Pi or small virtual machine practical.
• Cons: Linux-only portscan monitoring depends on iptables, is unavailable in Dockerized deployments, and does not use nftables.
• Cons: The configuration file must be protected carefully because writable settings can create a privilege-escalation risk.

Alternatives

Canarytokens is another free option, with token deployment through its hosted service and support for mobile, web, desktop and self-hosted platforms. Consider T-Pot for a free self-hosted honeypot on Linux, macOS or Windows if its hardware and network requirements suit your environment. Beelzebub offers a free self-hosted core framework for API and Linux deployments, with a free trial also available.

Cowrie is a free, BSD-licensed Linux honeypot focused on SSH and Telnet. Endlessh is a free standalone C SSH tarpit for Linux, with a default maximum of 4096 clients. Dionaea is a free, open-source Linux honeypot under GPLv2+. Heralding is a free GPL-3.0-licensed Linux honeypot. DentiGrid is a commercial MSSP and enterprise option for API, self-hosted and web deployments, with custom pricing.

Browse the Honeypot Software category for more options.

Verdict

Choose OpenCanary if you want a free, low-resource way to expose a broad set of network decoys and can operate a self-hosted Linux or macOS deployment. Its range of protocols and alert routes is the main draw; look elsewhere if you need a managed service, or if Linux's fuller module support and strict configuration-file permissions are poor fits.