opencanary: Deploy a Python Multi-Protocol Honeypot

Overview

OpenCanary is a lightweight, Python-based multi-protocol network honeypot from Thinkst. It imitates common network services so defenders can detect and receive alerts when someone interacts with a decoy inside a non-public network.

The core is cross-platform, though feature availability depends on the operating system. Linux provides the broadest set of options, and the project is designed to run with modest resources, including on a small computer or a minimally provisioned VM.

Key Features

• Emulates multiple common network protocols as decoy services.
• Sends alerts when potential threats interact with the honeypot, including the source IP address and where the breach may have occurred.
• Runs as a daemon and can drop root privileges after binding to ports.
• Offers optional SNMP, port-scan detection, and Windows file-share modules, with platform and dependency requirements.
• Can be installed as a Python package or run with Docker on Linux hosts.
• Supports configurable services and logging through a JSON configuration file.

Use Cases

• A network defender can place a decoy service on a non-public network to be alerted to suspicious access after a breach.
• A small security team can run a low-resource honeypot on a VM or Raspberry Pi without dedicating a large server to it.
• A Linux administrator can enable protocol and port-scan modules to observe interactions with a broader set of decoy services.
• A team using containers can deploy OpenCanary with Docker Compose on a Linux Docker host, while accounting for the disabled port-scan module.

Getting Started

On Ubuntu, create and activate a virtual environment, then install the package:

virtualenv env/
. env/bin/activate
pip install opencanary

See the README for configuration, optional modules, and Docker instructions.

Considerations

• OpenCanary requires Python 3.10 or later. Optional capabilities add dependencies: SNMP needs Scapy, the Windows file-share module needs Samba, and port-scan detection uses iptables and is supported only on Linux.
• The README warns that the configuration file is read with root privileges and can enable privilege escalation if writable by regular users. Keep it root-owned and writable only by root.
• Docker deployment requires a Linux host using host networking for accurate network information. The port-scan module is automatically disabled in Docker.
• Recent health data shows regular commits and releases, but only one issue closure in the measured recent period, so there is little recent issue-closure history to assess.
• The core project is cross-platform, but its modules are not uniformly available across operating systems.