Specifiction
For vendors
AdvertiseTop spots, featured rows, home sponsor Get listedAdd a product we don't cover yet Claim a listingFree: verify the domain, then correct your page Vendor dashboardNumbers, orders and placements
List your tool
Vendor dashboard
Tech riderRev. 2 Oct 2026

OpenCanary

Ch 017.3of 18 Honeypot Software
  1. 1Runs onLinux, Mac, self-hosted
  2. 2CostsFree plan
  3. 3Deployment modelself-hosted
  4. 4Decoy scopenetwork
  5. 5Credential luresYes
5 lines stated Written from the maker's own pages: github.com
Visit site Alternatives
The OpenCanary homepage

Overview

OpenCanary is free, self-hosted software that acts as a network honeypot, imitating services so it can alert when someone interacts with them after entering a non-public network. It runs as a daemon and can report details such as a source IP address and a possible breach location. Service modules cover SSH, FTP, Git, web protocols, databases, Telnet, SNMP, SIP, VNC, Redis, TFTP, NTP, and TCP banners. Alerts can go to files, Syslog, email, HTTP webhooks, Slack, Microsoft Teams, or HPFeeds-compatible daemons. Its companion correlator can combine related events into a single email or SMS alert. The project says it has very low resource requirements and can run on a Raspberry Pi or a minimally resourced virtual machine. Documentation covers Ubuntu, macOS, and Docker on Linux hosts. Linux supports the broadest set of options: SMB monitoring is unavailable on macOS, and portscan monitoring is Linux-only and disabled in Docker. The project advises restricting write access to its configuration file because it is read with root privileges.

Who it is for

OpenCanary suits teams that want a self-hosted decoy for detecting activity on non-public networks. It is also suited to low-resource deployments such as a Raspberry Pi.

What is good

  • Free, self-hosted deployment
  • Imitates a broad range of network services
  • Alerts support email, Syslog, webhooks, and chat
  • Can run on a Raspberry Pi

What to know first

  • SMB monitoring is unavailable on macOS
  • Portscan monitoring is Linux-only
  • Portscan monitoring is disabled in Docker
  • Configuration must be protected from writes

Verdict

OpenCanary offers broad protocol coverage and alert options without a software charge. Platform-specific module limits and careful configuration-file permissions matter before deployment.

OpenCanary plans and pricing

All plans
OpenCanary Free Open-source software · self-hosted deployment github.com · 2 Oct 2026

Compared on honeypot software

Free plan
Yesgithub.com
Deployment model
self-hostedgithub.com
Decoy scope
networkgithub.com
Credential lures
Yesgithub.com

Facts

Purpose
OpenCanary is a multi-protocol network honeypot intended to catch hackers after they breach non-public networks.github.com · 1 Oct 2026
Operation
It runs as a daemon implementing multiple common network protocols and sends alerts when attackers interact with it.github.com · 1 Oct 2026
Resource use
OpenCanary has extremely low resource requirements and can run on a Raspberry Pi or a minimally resourced virtual machine.github.com · 1 Oct 2026
Protocol mimicry
It can mimic an array of network-accessible services for attackers to interact with.github.com · 1 Oct 2026
Alert details
Alerts can identify the threat source IP address and where the breach may have occurred.github.com · 1 Oct 2026
Alert channels
The documentation lists Syslog, email, and the opencanary-correlator as alert destinations.github.com · 1 Oct 2026
Event correlation
The correlator coalesces multiple related events, such as individual brute-force login attempts, into one alert sent by email or SMS.github.com · 1 Oct 2026
Webhook integration
A customizable webhook logging handler sends data to an HTTP endpoint and supports GET, POST, and PUT methods.github.com · 1 Oct 2026
Chat integrations
Webhooks can post to Slack or Microsoft Teams channels.github.com · 1 Oct 2026
Optional modules
The optional SNMP module requires Scapy, while the Windows File Share module requires Samba.github.com · 1 Oct 2026
Portscan limit
The portscan module is supported only on Linux hosts because it modifies iptables rules, and it is automatically disabled in Dockerized OpenCanary.github.com · 1 Oct 2026
Security guidance
The project recommends making the configuration file root-owned and writable only by root because writable configuration can allow privilege escalation.github.com · 1 Oct 2026
License
The PyPI listing identifies OpenCanary as OSI Approved BSD licensed software.pypi.org · 1 Oct 2026
Support
Bug reports are requested through GitHub, security vulnerabilities through the project security policy, and feature requests through the project tracker.github.com · 1 Oct 2026
Protocols
Native service modules include SSH, FTP, Git, HTTP, HTTPS, HTTP proxy, MSSQL, MySQL, Telnet, SNMP, SIP, VNC, Redis, TFTP, NTP, and TCP banner.opencanary.readthedocs.io · 2 Oct 2026
Extra modules
Optional SMB monitoring watches Samba logs for files opened in a Windows file share, and optional portscan monitoring uses iptables to detect scans.opencanary.readthedocs.io · 2 Oct 2026
Alert destinations
Documented logging and alert options include files, Syslog, SMTP email, HTTP webhooks, Slack, Microsoft Teams, and HPFeeds-compatible daemons.opencanary.readthedocs.io · 2 Oct 2026
Correlator
The companion opencanary-correlator can combine related events into a single email or SMS alert.opencanary.readthedocs.io · 2 Oct 2026
Deployment
The project documents installation on Ubuntu and macOS, plus Docker deployment on Linux hosts using host networking.github.com · 2 Oct 2026
Platform limits
Linux offers the most options; the SMB module is unavailable on macOS, and portscan is Linux-only and uses iptables rather than nftables.github.com · 2 Oct 2026
Resource needs
The project says it has very low resource requirements and can run on a Raspberry Pi or a minimally resourced virtual machine.github.com · 2 Oct 2026
Security configuration
The project recommends making its configuration file root-owned and writable only by root because it is read while the process has root privileges.github.com · 2 Oct 2026
Privilege handling
When started with uid and gid flags, OpenCanary drops root privileges after binding to its ports.github.com · 2 Oct 2026
Security reports
Thinkst accepts vulnerability reports at [email protected] or through GitHub and says it will request a CVE on the reporter’s behalf for reported security bugs.github.com · 2 Oct 2026
Support and participation
The project directs bug reports to GitHub and welcomes pull requests and feature requests.github.com · 2 Oct 2026
Maintainer and commercial relation
OpenCanary is maintained by Thinkst Canary and described as the open-source version of its commercial Thinkst Canary honeypot.github.com · 2 Oct 2026

Best OpenCanary alternatives

See all 17
All accessCh 02 Beelzebub Free planFree trialAPI Free to start7.2 All accessCh 03 Canarytokens Free planAndroidiOS Free to start7.2 All accessCh 04 Honeyd Free planLinuxself-hosted Free to start7.0 All accessCh 05 T-Pot Free planLinuxMac Free to start7.0 All accessCh 06 Cowrie Free planLinuxself-hosted Free to start6.9 All accessCh 07 Honeytrap Free planLinuxself-hosted Free to start6.9

Where it ranks on Specifiction

Is OpenCanary yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote OpenCanary

Sources