OpenCanary

OpenCanary is a self-hosted honeypot that raises alerts when someone interacts with decoy network services. It suits defenders who want to monitor non-public networks on modest Linux or macOS infrastructure. Its wide range of decoys and alert routes make it a capable free option, but Linux offers more modules and safe operation depends on protecting its configuration.

Overview

Running as a daemon, OpenCanary mimics network-accessible services to catch activity after an attacker reaches a network that is not public. Native modules cover SSH, FTP, Git, HTTP, HTTPS, HTTP proxy, MSSQL, MySQL, Telnet, SNMP, SIP, VNC, Redis, TFTP, NTP and TCP banners. Alerts can include the source IP and an indication of where a breach may have occurred, giving defenders useful leads for investigation.

Its very low resource requirements make it practical to run on a Raspberry Pi or a minimally resourced virtual machine. OpenCanary is BSD-licensed open-source software maintained by Thinkst Canary, and is the open-source version of the company's commercial honeypot.

Key features

Alerting is flexible: destinations include files, Syslog, SMTP email, HTTP webhooks, Slack, Microsoft Teams and HPFeeds-compatible daemons. The customizable webhook handler supports GET, POST and PUT, so teams can send events to an HTTP endpoint and adapt delivery to their own systems. Chat notifications through Slack or Teams are available via webhooks.

The companion opencanary-correlator can combine related events, such as a sequence of individual brute-force login attempts, into one email or SMS alert. That reduces repetitive notifications while preserving a signal of the broader activity. Optional modules extend monitoring: SMB watches Samba logs for files opened in a Windows file share, while portscan monitoring uses iptables to detect scans.

These additions bring dependencies and deployment constraints. SNMP requires Scapy, and SMB monitoring requires Samba. Portscan monitoring is Linux-only, relies on iptables rather than nftables, and is automatically disabled in Dockerized OpenCanary.

Pricing

OpenCanary: free. This is open-source software for self-hosted deployment, with no software charge. The free plan suits operators able to provide and maintain their own host; it does not remove the need to configure alert delivery or secure the installation.

Platforms

OpenCanary supports Linux, macOS and self-hosted deployment, with the broadest options on Linux. The SMB module is unavailable on macOS, and portscan detection is limited to Linux. Docker deployment is documented for Linux hosts using host networking; the portscan module is disabled in Dockerized deployments.

Privilege handling deserves particular care. Because the configuration file is read while the process has root privileges, the project recommends making it root-owned and writable only by root; a writable configuration can permit privilege escalation. When started with uid and gid flags, OpenCanary drops root privileges after binding to its ports.

Who it's for

OpenCanary is a good fit for defenders who can self-host a network honeypot and want numerous service decoys without dedicating much compute capacity. Its alert options suit teams that can manage their own email, syslog, webhook or chat routing. It is a weaker fit for deployments that need portscan monitoring on macOS or in Docker, or SMB monitoring on macOS.

Pros and cons

• Broad native decoy coverage: modules span network, database and other common services, giving defenders multiple ways to attract and flag interaction.
• Lightweight self-hosting: Raspberry Pi and minimally resourced virtual machine support lowers the infrastructure hurdle.
• Flexible notifications: webhooks, chat routes and event correlation support different alert workflows and can consolidate related events.
• Uneven platform support: Linux has the fullest module set; macOS lacks SMB monitoring, while portscan detection requires Linux and iptables.
• Configuration security is operationally important: the root-read configuration must be writable only by root to avoid creating a privilege-escalation path.

Alternatives

Canarytokens is another free option, with platforms spanning Android, iOS, self-hosted, web and Windows; consider it when those platforms matter more than OpenCanary's network-service decoy approach. T-Pot is a free, self-hosted alternative for Linux, macOS and Windows, though its hardware and network requirements apply.

Beelzebub offers a free self-hosted core framework on Linux and API platforms, with a free trial also available. Cowrie is a free, BSD-licensed SSH and Telnet honeypot for Linux and self-hosting, a narrower stated scope than OpenCanary's multiple service modules.

Endlessh is a free standalone C SSH tarpit for Linux, with a default maximum of 4096 clients. Dionaea is a free, open-source Linux honeypot under GPLv2+. Heralding is a free Linux honeypot under GPL-3.0. Conpot is another free Linux honeypot.

Browse the Honeypot Software category for more options.

Verdict

Choose OpenCanary if you want a lightweight, free, self-hosted honeypot with broad network-service decoys and multiple alert routes. Its main advantage is the combination of protocol breadth and low resource needs; look elsewhere if your deployment depends on portscan monitoring outside Linux with iptables, or on SMB monitoring under macOS.