{"name":"opencanary: Deploy a Python Multi-Protocol Honeypot","description":"OpenCanary is a lightweight, Python-based network honeypot that imitates common services to detect activity after a breach of a non-public network. It runs on Linux and macOS, with some features limited to particular operating systems.","github":"https://github.com/thinkst/opencanary","url":"https://osrepos.com/repo/thinkst-opencanary","source":"osrepos.com","sourceDescription":"This repository profile is provided by osrepos.com, an open source repository discovery platform.","repositoryProfile":"https://osrepos.com/repo/thinkst-opencanary","generatedFor":"open source discovery and AI-assisted research","markdown":"https://osrepos.com/repo/thinkst-opencanary.md","json":"https://osrepos.com/repo/thinkst-opencanary.json","topics":["python","security","networking","cybersecurity","honeypot","network-honeypot"],"keywords":["python","security","networking","cybersecurity","honeypot","network-honeypot"],"stars":null,"summary":"OpenCanary is a lightweight, Python-based network honeypot that imitates common services to detect activity after a breach of a non-public network. It runs on Linux and macOS, with some features limited to particular operating systems.","content":"## Overview\n\nOpenCanary is a lightweight, Python-based multi-protocol network honeypot from Thinkst. It imitates common network services so defenders can detect and receive alerts when someone interacts with a decoy inside a non-public network.\n\nThe core is cross-platform, though feature availability depends on the operating system. Linux provides the broadest set of options, and the project is designed to run with modest resources, including on a small computer or a minimally provisioned VM.\n\n## Key Features\n\n- Emulates multiple common network protocols as decoy services.\n- Sends alerts when potential threats interact with the honeypot, including the source IP address and where the breach may have occurred.\n- Runs as a daemon and can drop root privileges after binding to ports.\n- Offers optional SNMP, port-scan detection, and Windows file-share modules, with platform and dependency requirements.\n- Can be installed as a Python package or run with Docker on Linux hosts.\n- Supports configurable services and logging through a JSON configuration file.\n\n## Use Cases\n\n- A network defender can place a decoy service on a non-public network to be alerted to suspicious access after a breach.\n- A small security team can run a low-resource honeypot on a VM or Raspberry Pi without dedicating a large server to it.\n- A Linux administrator can enable protocol and port-scan modules to observe interactions with a broader set of decoy services.\n- A team using containers can deploy OpenCanary with Docker Compose on a Linux Docker host, while accounting for the disabled port-scan module.\n\n## Our Take\nOpenCanary is an actively maintained, lightweight honeypot with a broad contributor base, though recent issue-closure data is limited.\n\n**Good fit if:**\n- You need alerts when someone interacts with decoy network services inside a network.\n- You want a Python honeypot that can run with modest resources and can tailor modules to Linux, macOS, or a Linux Docker host.\n- You value a project with regular recent commits and releases and contributions from many people.\n\n**Look elsewhere if:**\n- You need the port-scan module on a non-Linux system or in a Docker deployment.\n- You need the Windows file-share module on macOS, or do not want to install and configure Samba for it.\n- You need a honeypot that does not require Python 3.10 or later.\n\n## Project Health\n\n| Signal | Value |\n|---|---|\n| Status | **Active**: regular commits and releases |\n| Last commit | 2026-10-27 (14 days ago) |\n| Commits, last 90 days | 15 |\n| Releases, last 12 months | 4 (latest v0.9.10, 2026-09-21) |\n| Contributors | 56 (top contributor: 33% of commits) |\n| Issues closed, last 90 days | 1 |\n| Pull requests merged, last 90 days | 14 (typically merged in 1 day) |\n| Project age | 11 years |\n\nChecked on 2026-11-10 with the GitHub API.\n\n## Project Facts\n\n- Language: Python\n- License: BSD-3-Clause\n- Stars: 3.1k\n- Forks: 423\n- Website: http://opencanary.org\n- Archived: no\n\n## What You Need\n\nDetected in the repository:\n\n- Python >= 3.10 (from pyproject.toml)\n- A Compose file to run it with its related services\n- Automated checks on GitHub Actions\n\n## Getting Started\n\nOn Ubuntu, create and activate a virtual environment, then install the package:\n\n```bash\nvirtualenv env/\n. env/bin/activate\npip install opencanary\n```\n\nSee the [README](https://github.com/thinkst/opencanary) for configuration, optional modules, and Docker instructions.\n\n## License in Plain Words\n\n**BSD-3-Clause** (permissive).\n\n- Commercial use: yes\n- Modify and redistribute: yes\n- You must keep: the copyright and license notice; the authors' names cannot endorse your product\n- Share your changes: no\n\nA summary, not legal advice: the LICENSE file is what applies.\n\n## Considerations\n\n- OpenCanary requires Python 3.10 or later. Optional capabilities add dependencies: SNMP needs Scapy, the Windows file-share module needs Samba, and port-scan detection uses iptables and is supported only on Linux.\n- The README warns that the configuration file is read with root privileges and can enable privilege escalation if writable by regular users. Keep it root-owned and writable only by root.\n- Docker deployment requires a Linux host using host networking for accurate network information. The port-scan module is automatically disabled in Docker.\n- Recent health data shows regular commits and releases, but only one issue closure in the measured recent period, so there is little recent issue-closure history to assess.\n- The core project is cross-platform, but its modules are not uniformly available across operating systems.","metrics":{"detailViews":5,"githubClicks":2},"dates":{"published":null,"modified":"2026-11-10T23:50:48.000Z"}}