OpenCanary

OpenCanary is an open-source network honeypot designed to detect intruders after they have breached non-public networks. It runs as a daemon and implements various common network protocols to attract and identify unauthorized activity. The software is deployed as a server application on Linux or macOS, and it can also be run via Docker containers using the host network engine for accurate information.

The application operates by mimicking network-accessible services that appear as legitimate targets to an attacker. When an intruder interacts with these services, the software generates alerts that identify the source IP address and the specific point where the breach occurred. It is designed with low resource requirements, allowing it to run on minimal hardware such as a Raspberry Pi or a small virtual machine without impacting system performance.

Key features

• Mimics multiple network-accessible services to attract attackers
• Sends alerts upon detection of potential threats
• Identifies the source IP address of the intruder
• Supports deployment on Linux and macOS
• Includes a portscan detection module for Linux hosts
• Provides a Windows File Share module via Samba integration
• Supports SNMP monitoring through the Scapy library
• Allows privilege dropping after binding to ports for security

Implemented in Python, the core honeypot is cross-platform, though specific modules like port scanning require Linux-based operating systems and the use of iptables. Configuration is managed through a JSON file where users enable specific protocols and define logging options. The software can be installed via pip, uv, or pkgx, and it supports deployment via Ansible roles for automated setup across multiple nodes. It is intended for security administrators who need a lightweight mechanism to detect lateral movement within a private network environment.

OpenCanary serves as a detection tool for internal network security monitoring.