OpenSource-Hub
O

OpenCanary

2.9k stars·System Optimization·SHA-256 checksum verified

OpenCanary is a multi-protocol network honeypot designed to detect attackers after they've breached internal networks. It mimics services like HTTP, FTP, SMB, SSH, and Telnet with minimal resource usage.

Smart Download

Visit Project Homepage

No installer available yet — head to the source repository

A lightweight honeypot that runs on a Raspberry Pi and catches intruders by simulating dozens of network services.

Core Features

  • Emulates 10+ common network protocols (HTTP, FTP, SMB, SSH, Telnet, etc.)
  • Instant alerts via email, Syslog, or custom integrations when any service is touched
  • Extremely lightweight – runs on a Raspberry Pi or a VM with 128MB RAM
  • Cross-platform (Linux/macOS) Python daemon with Docker support
  • Configuration via single JSON file – enable/disable modules and alerting

What It Can't Do

  • Portscan module works only on Linux with iptables, not nftables. 2. SNMP module requires Scapy library. 3. Samba module needs system Samba installed (Linux only). 4. Running OpenCanary typically requires root (for low ports or iptables). 5. Docker containers must use `--network host` to see real source IPs, otherwise only Docker bridge IPs appear.

Use Cases

  • Deploy inside corporate networks to detect lateral movement by attackers
  • Build a honeypot farm or training environment to collect attack patterns
  • Create a low-cost intrusion detection system using a Raspberry Pi

OpenCanary is an open-source network honeypot that mimics multiple common protocols (HTTP, FTP, SMB, SSH, Telnet, etc.) to lure attackers inside your network. When an attacker interacts with any simulated service, OpenCanary instantly sends alerts via email, Syslog, or custom integrations. Built in Python, it consumes extremely few resources — you can run it on a Raspberry Pi or a tiny VM. It’s ideal for organizations that want early breach detection without adding complexity. Compared to single-protocol honeypots like Cowrie (only SSH/Telnet) or heavyweight suites like T-Pot, OpenCanary offers a balanced trade-off: many protocols in a tiny footprint, with easy configuration via JSON.

Tags

honeypotnetwork-securityintrusion-detectionpythonlightweightmulti-protocol

Getting Started

1

Download installer

Click the button above to download the installer for your system

2

Install the software

Double-click the downloaded installer and follow the prompts

3

Step 1: On Ubuntu/Mac, install Python 3.10+, create a virtualenv, and run `pip install opencanary`

4

Step 2: As root, run `opencanaryd --copyconfig` to generate a default config file

5

Step 3: Edit `/etc/opencanaryd/opencanary.conf` to enable desired services (e.g., HTTP, FTP) and alert methods

Install Guide
  1. Step 1: On Ubuntu/Mac, install Python 3.10+, create a virtualenv, and run `pip install opencanary`
  2. Step 2: As root, run `opencanaryd --copyconfig` to generate a default config file
  3. Step 3: Edit `/etc/opencanaryd/opencanary.conf` to enable desired services (e.g., HTTP, FTP) and alert methods
File Integrity

Checksum not available

This project has not published a SHA-256 checksum on its GitHub Release page

SHA256 Checksum

No checksum available

Download directly from GitHub Releases and verify file integrity yourself

All SHA-256 checksums on this platform are extracted from the project's official GitHub Release page, without any modification. You can independently verify them on the GitHub Releases page.

Open Source Transparency

View GitHub Source
Environment Guide

Uninstall Info

Delete the virtual environment directory, remove /etc/opencanaryd/, and run `pip uninstall opencanary`. Optionally uninstall Samba or Scapy if no longer needed.

No Extra Dependencies

Ready to use after download. No additional runtime required.

Project Info
LicenseBSD-2-Clause
Last Updated2026-06-26 20:45:16
GitHub RepositoryOfficial Website

Having issues? Check the FAQ below

3 FAQs

Similar Projects