OpenCanary vs TANNER

OpenCanary is free, self-hosted software that acts as a network honeypot, imitating services so it can alert when someone interacts with them after entering a non-public network. It runs as a daemon and can report details such as a source IP address and a possible breach location. Service modules cover SSH, FTP, Git, web protocols, databases, Telnet, SNMP, SIP, VNC, Redis, TFTP, NTP, and TCP banners. Alerts can go to files, Syslog, email, HTTP webhooks, Slack, Microsoft Teams, or HPFeeds-compatible daemons. Its companion correlator can combine related events into a single email or SMS alert. The project says it has very low resource requirements and can run on a Raspberry Pi or a minimally resourced virtual machine. Documentation covers Ubuntu, macOS, and Docker on Linux hosts. Linux supports the broadest set of options: SMB monitoring is unavailable on macOS, and portscan monitoring is Linux-only and disabled in Docker. The project advises restricting write access to its configuration file because it is read with root privileges.

TANNER has no write-up on Specifiction yet; its figures are above.