# opencanary: Deploy a Python Multi-Protocol Honeypot This repository profile is provided by osrepos.com, an open source repository discovery platform. Source: osrepos.com Repository profile: https://osrepos.com/repo/thinkst-opencanary Generated for open source discovery and AI-assisted research. OpenCanary is a lightweight, Python-based network honeypot that imitates common services to detect activity after a breach of a non-public network. It runs on Linux and macOS, with some features limited to particular operating systems. GitHub: https://github.com/thinkst/opencanary OSRepos URL: https://osrepos.com/repo/thinkst-opencanary ## Summary OpenCanary is a lightweight, Python-based network honeypot that imitates common services to detect activity after a breach of a non-public network. It runs on Linux and macOS, with some features limited to particular operating systems. ## Topics - python - security - networking - cybersecurity - honeypot - network-honeypot ## Repository Information Last analyzed by OSRepos: Tue Nov 10 2026 23:50:48 GMT+0000 (Western European Standard Time) Detail views: 5 GitHub clicks: 2 ## Safety Notice OSRepos shares public repositories for knowledge and discovery only. Review source code, dependencies, licenses, and security implications before running or installing anything. ## Content ## Overview OpenCanary is a lightweight, Python-based multi-protocol network honeypot from Thinkst. It imitates common network services so defenders can detect and receive alerts when someone interacts with a decoy inside a non-public network. The core is cross-platform, though feature availability depends on the operating system. Linux provides the broadest set of options, and the project is designed to run with modest resources, including on a small computer or a minimally provisioned VM. ## Key Features - Emulates multiple common network protocols as decoy services. - Sends alerts when potential threats interact with the honeypot, including the source IP address and where the breach may have occurred. - Runs as a daemon and can drop root privileges after binding to ports. - Offers optional SNMP, port-scan detection, and Windows file-share modules, with platform and dependency requirements. - Can be installed as a Python package or run with Docker on Linux hosts. - Supports configurable services and logging through a JSON configuration file. ## Use Cases - A network defender can place a decoy service on a non-public network to be alerted to suspicious access after a breach. - A small security team can run a low-resource honeypot on a VM or Raspberry Pi without dedicating a large server to it. - A Linux administrator can enable protocol and port-scan modules to observe interactions with a broader set of decoy services. - A team using containers can deploy OpenCanary with Docker Compose on a Linux Docker host, while accounting for the disabled port-scan module. ## Our Take OpenCanary is an actively maintained, lightweight honeypot with a broad contributor base, though recent issue-closure data is limited. **Good fit if:** - You need alerts when someone interacts with decoy network services inside a network. - You want a Python honeypot that can run with modest resources and can tailor modules to Linux, macOS, or a Linux Docker host. - You value a project with regular recent commits and releases and contributions from many people. **Look elsewhere if:** - You need the port-scan module on a non-Linux system or in a Docker deployment. - You need the Windows file-share module on macOS, or do not want to install and configure Samba for it. - You need a honeypot that does not require Python 3.10 or later. ## Project Health | Signal | Value | |---|---| | Status | **Active**: regular commits and releases | | Last commit | 2026-10-27 (14 days ago) | | Commits, last 90 days | 15 | | Releases, last 12 months | 4 (latest v0.9.10, 2026-09-21) | | Contributors | 56 (top contributor: 33% of commits) | | Issues closed, last 90 days | 1 | | Pull requests merged, last 90 days | 14 (typically merged in 1 day) | | Project age | 11 years | Checked on 2026-11-10 with the GitHub API. ## Project Facts - Language: Python - License: BSD-3-Clause - Stars: 3.1k - Forks: 423 - Website: http://opencanary.org - Archived: no ## What You Need Detected in the repository: - Python >= 3.10 (from pyproject.toml) - A Compose file to run it with its related services - Automated checks on GitHub Actions ## Getting Started On Ubuntu, create and activate a virtual environment, then install the package: ```bash virtualenv env/ . env/bin/activate pip install opencanary ``` See the [README](https://github.com/thinkst/opencanary) for configuration, optional modules, and Docker instructions. ## License in Plain Words **BSD-3-Clause** (permissive). - Commercial use: yes - Modify and redistribute: yes - You must keep: the copyright and license notice; the authors' names cannot endorse your product - Share your changes: no A summary, not legal advice: the LICENSE file is what applies. ## Considerations - OpenCanary requires Python 3.10 or later. Optional capabilities add dependencies: SNMP needs Scapy, the Windows file-share module needs Samba, and port-scan detection uses iptables and is supported only on Linux. - The README warns that the configuration file is read with root privileges and can enable privilege escalation if writable by regular users. Keep it root-owned and writable only by root. - Docker deployment requires a Linux host using host networking for accurate network information. The port-scan module is automatically disabled in Docker. - Recent health data shows regular commits and releases, but only one issue closure in the measured recent period, so there is little recent issue-closure history to assess. - The core project is cross-platform, but its modules are not uniformly available across operating systems.