Overview

OpenCanary runs as a daemon, presenting decoy network services and alerting when they are accessed. Native modules span SSH, FTP, Git, HTTP and HTTPS, HTTP proxy, MSSQL, MySQL, Telnet, SNMP, SIP, VNC, Redis, TFTP, NTP and TCP banner. That range lets teams create lures across several common service types rather than relying on a single-protocol honeypot. Alerts can identify the source IP and indicate where a breach may have occurred, providing a useful starting point for investigation.

Resource requirements are low enough for a Raspberry Pi or a minimally resourced virtual machine. This makes OpenCanary practical for adding network decoys without dedicating substantial compute capacity. The project is maintained by Thinkst Canary as the open-source version of its commercial honeypot, and the PyPI listing identifies it as OSI Approved BSD-licensed software.

Key features

Alert routing is a particular strength. Documented destinations include files, Syslog, SMTP email, HTTP webhooks, Slack, Microsoft Teams and HPFeeds-compatible daemons. The customizable webhook handler supports GET, POST and PUT, so teams can direct event data to an HTTP endpoint; webhooks can also post to Slack or Teams channels. These choices are useful for fitting alerts into existing monitoring workflows, though configuring those destinations remains part of operating a self-hosted service.

The companion opencanary-correlator can combine related events, such as repeated brute-force login attempts, into one email or SMS alert. That can reduce noisy alert streams while retaining a summary of a related sequence. Optional modules add Samba-log monitoring for files opened in a Windows file share and portscan detection through iptables.

Privilege handling deserves attention. When started with uid and gid flags, OpenCanary drops root privileges after binding to its ports. The project recommends making the configuration file root-owned and writable only by root: because the process reads it with root privileges, a writable configuration could enable privilege escalation. This is a meaningful deployment requirement, not an optional hardening detail.

Pricing

OpenCanary costs 0.00 USD per free. The OpenCanary plan is open-source software for self-hosted deployment, with no software charge. That makes it a fit for teams prepared to run and configure their own honeypot; the trade-off is that operation and alert setup are their responsibility.

Platforms

OpenCanary supports Linux, macOS and self-hosted deployment. Linux offers the broadest module choice: the SMB module is unavailable on macOS, while portscan monitoring is Linux-only because it modifies iptables rules and does not use nftables. Portscan monitoring is also automatically disabled in Dockerized OpenCanary. Docker deployment is documented for Linux hosts using host networking, so container users should not assume every module remains available.

The project documents installation on Ubuntu and macOS. Optional SNMP monitoring requires Scapy, and the Windows File Share module requires Samba. Those dependencies and platform restrictions matter when selecting a host and deciding which decoys to enable.

Who it's for

OpenCanary is best suited to defenders who want several network-service decoys on modest self-hosted infrastructure and can maintain a protected configuration file. It is particularly compelling when low resource use and flexible alert destinations matter. It is a weaker fit for teams that need the portscan module on macOS or in Docker, or that cannot manage host permissions and alert routing themselves.

Pros and cons

Pros: Broad native protocol coverage gives defenders multiple service types to imitate with one daemon.
Pros: Low resource needs make deployment on a Raspberry Pi or minimally resourced virtual machine practical.
Pros: File, Syslog, email, webhook, chat and HPFeeds-compatible destinations provide multiple ways to route alerts.
Cons: Linux has the fullest feature set; SMB is unavailable on macOS and portscan monitoring is Linux-only.
Cons: Portscan detection relies on iptables and is disabled in Dockerized deployments, limiting its fit for nftables-based hosts and containers.
Cons: Configuration permissions require care because a writable file can create a privilege-escalation risk.

Alternatives

Honeypot Software is the broader category to browse. Among individual options, Beelzebub is another free, self-hosted choice, with Linux and API platform support and a free trial. Canarytokens is worth considering when free tokens deployed through its hosted service are a better fit than operating a multi-protocol daemon; it spans web, mobile, Windows and self-hosted platforms.

Honeyd is another free Linux and Windows self-hosted option, while T-Pot offers a free open-source self-hosted deployment across Linux, macOS and Windows, with hardware and network requirements applying. Cowrie is a free BSD-licensed SSH and Telnet honeypot for Linux self-hosting, a narrower protocol focus than OpenCanary's. Honeytrap is a free Apache-licensed self-managed option for Linux, and Heralding is a free GPL-3.0 licensed Linux self-hosted honeypot.

Thinkst Canary is the paid alternative from the same maintainer, with five canaries for 7500.00 USD per year and hardware, virtual, cloud or container deployment options. It is the option to consider when those deployment choices justify a paid commercial product rather than self-managing OpenCanary.

Verdict

Choose OpenCanary if you want a free, resource-light honeypot with a wide range of service decoys and can operate it securely on a self-hosted system. Its strongest case is breadth without a software charge; look elsewhere if your required module is unavailable on your platform or you cannot take responsibility for careful configuration and alert handling.

	Cowrie	OpenCanary
Free plan	Yes	Yes
Paid from	Free	Free
Platforms	Linux, self-hosted	Linux, macOS, self-hosted
Free plan	Yes	Yes
Deployment model	self-hosted	self-hosted
Decoy scope	multi-layer	network
Credential lures	Yes	Yes

Cowrie vs OpenCanary

Cowrie

OpenCanary