OpenCanary is a lightweight network honeypot designed to reveal intruders who are exploring systems they should not be accessing. It runs as a daemon and presents decoy network services that look potentially useful to an attacker. Interactions with these services are recorded and can generate alerts, providing an early indication of reconnaissance or lateral movement inside a network.
The software is deliberately economical with resources, making it practical to distribute multiple sensors around an environment rather than relying on a single large honeypot. It can run on modest virtual machines and low-power hardware. Operators select the services they want to expose and customise their behaviour through configuration rather than maintaining deliberately vulnerable applications.
This is free and open source software.
Key Features
- Emulates Git, FTP, HTTP, HTTPS, HTTP proxy, MySQL, Microsoft SQL Server, Redis, RDP, SIP, SSH, Telnet, TFTP, VNC and other network services.
- Configurable ports, service banners and protocol-specific behaviour.
- Optional SNMP support using Scapy.
- Windows file-share monitoring through integration with Samba.
- Port-scan detection on Linux systems using iptables.
- Generic TCP banner module for creating additional decoy listeners.
- Supports honey credentials for the Telnet service.
- Can ignore selected IP addresses and log-event types.
- Provides console and file logging with extensible alerting configuration.
- Docker deployment is supported on Linux hosts.
- Can drop root privileges after binding to privileged network ports.
- Individual protocol modules can be independently enabled or disabled.
Website: github.com/thinkst/opencanary
Support:
Developer: Thinkst
License: BSD 3-Clause “New” or “Revised” License
OpenCanary is written in Python. Learn Python with our recommended free books and free tutorials.
Related Software
| Honeypot Tools | |
|---|---|
| OpenCanary | Multi-protocol network decoy for detecting attacks |
| Dionaea | Traps exploits and captures malware samples |
| SentryPeer | Spots malicious SIP traffic and attempts to abuse VoIP systems |
| Heralding | Records usernames and passwords submitted by attackers |
| h0neytr4p | Web-focused trap for inspecting hostile HTTP requests and probing |
Read our verdict in the software roundup.
 Explore our carefully curated directory of recommended free and open source software, covering every major software category.The directory forms part of our extensive collection of articles for Linux enthusiasts. It includes hundreds of detailed reviews, together with free and open source alternatives to proprietary software from companies such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. LinuxLinks also covers interesting projects worth exploring, Linux-compatible hardware, free programming books and tutorials, and much more. Know a useful free and open source Linux application that we haven’t covered? Tell us about it using our submission form. |
Please read our Comment Policy before commenting.