Freedom251 › Honeypot Software
Heralding
What Heralding is
Heralding is a self-hosted network honeypot that collects credentials from connections across supported protocols. It supports FTP, Telnet, SSH, HTTP, HTTPS, POP3 and POP3S, along with IMAP, IMAPS, SMTP, VNC, PostgreSQL and SOCKS5. When a protocol exposes them, its authentication log records usernames and plaintext passwords. Heralding also saves authentication attempts, session summaries and full session data to CSV and JSON Lines files. Session records can include timestamps, duration, source and destination IP addresses and ports, protocol, authentication attempts and protocol-specific details. Authentication entries appear when a password is transmitted, while session logs are written after the session ends. The project README describes pip installation on Debian-based systems and Docker deployment using a port mapping; it requires Python 3.7.0 or higher. For separate packet captures for each session, the README points to Curisoum and says to enable it in Heralding.yml. The project is GPL-3.0 licensed, and its listed plan is free.
Who it suits
Heralding suits Linux users who want to collect credentials through a self-hosted network honeypot. It is aimed at people looking for captured authentication and session records.
What it does well
- Supports a wide range of network protocols.
- Records plaintext passwords when protocols make them available.
- Writes authentication and session data to CSV and JSON Lines.
- README describes both pip and Docker deployment.
What to know first
- Requires Python 3.7.0 or higher.
- Session logs appear only after a session ends.
- Plaintext passwords are recorded when available.
Limits
The plan is free and GPL-3.0 licensed. Session logs are written after a session ends, while authentication entries appear when a password has been transmitted.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Heralding | GPL-3.0 licensed open-source honeypot | Free |
As github.com lists them, read 3 Oct 2026. The maker's own page has the final word.
Getting started
- Open the Heralding GitHub project page.
- Use the pip instructions for a Debian-based system, or follow the README’s Docker build and port-mapping instructions.
- Provide Python 3.7.0 or higher for the pip installation.
- To create separate PCAP files per session, follow the README’s Curisoum instructions and enable it in Heralding.yml.
Verdict
Heralding combines credential capture with detailed session logging across many protocols. Its records and deployment options make it suitable for self-hosting, while log timing and plaintext credential capture are important to account for.
Questions
How much does Heralding cost?
Its listed plan is free, and the pricing model is free.
Is Heralding open source?
Yes. GitHub identifies it as GPL-3.0 licensed.
Which platforms does it support?
It is listed for Linux and self-hosted deployment.
Which protocols can it capture credentials from?
It supports FTP, Telnet, SSH, HTTP, HTTPS, POP3, POP3S, IMAP, IMAPS, SMTP, VNC, PostgreSQL and SOCKS5.
What does it record?
It records authentication attempts, session summaries and session data to CSV and JSON Lines files. Usernames and plaintext passwords are logged when the protocol makes them available.
Can it create packet captures?
The README points to Curisoum for a separate PCAP per session and says to enable it in Heralding.yml.
Facts from Heralding's own pages
- Authentication capture
- The auth log records usernames and plaintext passwords when the protocol makes them available. · github.com, 3 Oct 2026
- Container deployment
- The project README describes building a Docker image and running it with a port mapping. · github.com, 3 Oct 2026
- Installation
- The README gives pip installation instructions and describes running Heralding on a Debian-based system. · github.com, 3 Oct 2026
- Intended users
- The project describes itself as a honeypot for users who want to collect credentials. · github.com, 3 Oct 2026
- License
- GitHub identifies the project as GPL-3.0 licensed. · github.com, 3 Oct 2026
- Log timing
- Session log entries are written after a session ends, while auth log entries appear when a password has been transmitted. · github.com, 3 Oct 2026
- Packet capture
- The README points to Curisoum for creating a separate PCAP for each Heralding session and says to enable it in Heralding.yml. · github.com, 3 Oct 2026
- Protocols
- It supports FTP, Telnet, SSH, HTTP, HTTPS, POP3, POP3S, IMAP, IMAPS, SMTP, VNC, PostgreSQL and SOCKS5. · github.com, 3 Oct 2026
- Purpose
- Heralding is a simple honeypot that collects credentials. · github.com, 3 Oct 2026
- Requirements
- The README states that Python 3.7.0 or higher is required. · github.com, 3 Oct 2026
- Session details
- Session data can include timestamps, duration, source and destination IP and port, protocol, authentication attempts and protocol-specific auxiliary data. · github.com, 3 Oct 2026
- Session logs
- It writes authentication attempts, session summaries and complete session data to CSV and JSON Lines files. · github.com, 3 Oct 2026
Where Heralding stands on Freedom251
- Honeypot Software#8 of 21