OpenCanary

OpenCanary is a Python daemon that runs modular honeypot services, including SSH, SMB, HTTP, FTP, MySQL, and portscan sensors, and logs interactions to files, syslog, email, or webhooks such as Slack and Teams. Thinkst describes it as the open source version of its commercial Thinkst Canary product.

Self-managed decoy services on internal network segments without commercial licensing.

• +Many protocol modules in one daemon, with low resource requirements according to its README.
• +BSD-licensed and installable with pip or Docker.
• +Same vendor lineage as the commercial Canary platform.

• +Some modules are platform-bound: portscan runs only on Linux, and the SMB module is not available on macOS.
• +Alerting depends on log handlers set in a JSON config file, with an optional correlator daemon for email and SMS alerts.

Detecting scanning and lateral movement on internal segments through service decoys.