OpenCanary

Input—per 1M tokens

Output—per 1M tokens

Context—tokens

WeightsClosed

About

OpenCanary is ranked #5 of 18 in honeypot software on Inferse. It runs on Linux, macOS, Self-hosted. There is a free plan.

Compared on honeypot software

Free plan: Yesgithub.com
Deployment model: self-hostedgithub.com
Decoy scope: networkgithub.com
Credential lures: Yesgithub.com

Facts

Purpose: OpenCanary is a multi-protocol network honeypot intended to catch hackers after they breach non-public networks.github.com · 1 Oct 2026
Operation: It runs as a daemon implementing multiple common network protocols and sends alerts when attackers interact with it.github.com · 1 Oct 2026
Resource use: OpenCanary has extremely low resource requirements and can run on a Raspberry Pi or a minimally resourced virtual machine.github.com · 1 Oct 2026
Protocol mimicry: It can mimic an array of network-accessible services for attackers to interact with.github.com · 1 Oct 2026
Alert details: Alerts can identify the threat source IP address and where the breach may have occurred.github.com · 1 Oct 2026
Alert channels: The documentation lists Syslog, email, and the opencanary-correlator as alert destinations.github.com · 1 Oct 2026
Event correlation: The correlator coalesces multiple related events, such as individual brute-force login attempts, into one alert sent by email or SMS.github.com · 1 Oct 2026
Webhook integration: A customizable webhook logging handler sends data to an HTTP endpoint and supports GET, POST, and PUT methods.github.com · 1 Oct 2026
Chat integrations: Webhooks can post to Slack or Microsoft Teams channels.github.com · 1 Oct 2026
Optional modules: The optional SNMP module requires Scapy, while the Windows File Share module requires Samba.github.com · 1 Oct 2026
Portscan limit: The portscan module is supported only on Linux hosts because it modifies iptables rules, and it is automatically disabled in Dockerized OpenCanary.github.com · 1 Oct 2026
Security guidance: The project recommends making the configuration file root-owned and writable only by root because writable configuration can allow privilege escalation.github.com · 1 Oct 2026
License: The PyPI listing identifies OpenCanary as OSI Approved BSD licensed software.pypi.org · 1 Oct 2026
Support: Bug reports are requested through GitHub, security vulnerabilities through the project security policy, and feature requests through the project tracker.github.com · 1 Oct 2026
Purpose: OpenCanary is a multi-protocol network honeypot intended to detect attackers interacting with services on non-public networks.github.com · 2 Oct 2026
Operation: It runs as a daemon that imitates network services and sends alerts when they are accessed.github.com · 2 Oct 2026
Protocols: Native service modules include SSH, FTP, Git, HTTP, HTTPS, HTTP proxy, MSSQL, MySQL, Telnet, SNMP, SIP, VNC, Redis, TFTP, NTP, and TCP banner.opencanary.readthedocs.io · 2 Oct 2026
Extra modules: Optional SMB monitoring watches Samba logs for files opened in a Windows file share, and optional portscan monitoring uses iptables to detect scans.opencanary.readthedocs.io · 2 Oct 2026
Alert destinations: Documented logging and alert options include files, Syslog, SMTP email, HTTP webhooks, Slack, Microsoft Teams, and HPFeeds-compatible daemons.opencanary.readthedocs.io · 2 Oct 2026
Correlator: The companion opencanary-correlator can combine related events into a single email or SMS alert.opencanary.readthedocs.io · 2 Oct 2026
Deployment: The project documents installation on Ubuntu and macOS, plus Docker deployment on Linux hosts using host networking.github.com · 2 Oct 2026
Platform limits: Linux offers the most options; the SMB module is unavailable on macOS, and portscan is Linux-only and uses iptables rather than nftables.github.com · 2 Oct 2026
Resource needs: The project says it has very low resource requirements and can run on a Raspberry Pi or a minimally resourced virtual machine.github.com · 2 Oct 2026
Security configuration: The project recommends making its configuration file root-owned and writable only by root because it is read while the process has root privileges.github.com · 2 Oct 2026
Privilege handling: When started with uid and gid flags, OpenCanary drops root privileges after binding to its ports.github.com · 2 Oct 2026
Security reports: Thinkst accepts vulnerability reports at [email protected] or through GitHub and says it will request a CVE on the reporter’s behalf for reported security bugs.github.com · 2 Oct 2026
Support and participation: The project directs bug reports to GitHub and welcomes pull requests and feature requests.github.com · 2 Oct 2026
Maintainer and commercial relation: OpenCanary is maintained by Thinkst Canary and described as the open-source version of its commercial Thinkst Canary honeypot.github.com · 2 Oct 2026