OpenCanary

#What it is

A honeypot is a fake system whose only job is to be touched. Nothing legitimate should ever connect to it, so any connection is suspicious.

OpenCanary, from Thinkst, is an open-source honeypot daemon written in Python. It emulates services such as FTP, SSH, Telnet, MySQL, RDP and a web login page, and writes one JSON line per interaction: source IP, port, and often the usernames and passwords that were tried.

#Why I use it

On a home network behind NAT, with no ports forwarded, a honeypot won't attract internet attackers, and it shouldn't. It's a tripwire for things already inside: a compromised IoT device scanning its neighbours, malware moving sideways, or an infected laptop a visitor brought round. A router would never notice any of that.

#Benefits

• High signal, almost no noise. Unlike most detections, there's no baseline to tune. Zero legitimate traffic means every hit is worth a look.
• Cheap. A handful of Python processes.
• Structured JSON logs that drop straight into Loki and drive a Telegram alert.
• Fun to test: scan it with nmap and watch your phone buzz.

#Trade-offs

• Shallow emulation. It fakes the login, not the system. A careful attacker can tell. That's fine for a tripwire.
• Runs as root in the simple setup, because it binds low ports like 21 and 23. Running it as a low-privilege user is a sensible hardening step.
• Its logs are attacker-controlled text. Never feed them raw to an AI agent. See prompt injection.
• Better with its own IP. Sharing the Pi's address means the fake services sit beside real ones. A dedicated address that nothing legitimate ever talks to makes any packet to it suspicious.

#Gotchas I hit

• opencanaryd --copyconfig is broken inside a virtualenv. It calls the system python3, fails to copy the file, then prints a success message anyway. Copy settings.json by hand.
• "More than one service uses this port (http, httpproxy)". The HTTP proxy module also defaults to 8080, and OpenCanary refuses to start on a clash even for disabled modules. Move httpproxy.port elsewhere.
• The systemd unit needs the venv first in PATH, for the same reason --copyconfig fails.
• Check what's already listening before picking ports. My Pi's real xrdp owned 3389, so the fake RDP stayed off.