Home Network Honeypot with OpenCanary
A decoy device that alerts you the moment anyone on your network pokes at it.
A honeypot looks like a juicy target — a file server, a remote desktop — but nobody legitimate should ever touch it. Any connection is an early warning of a compromised device.
Run honeypots only on networks you own. They are for detection — never use them to attack back.
Video tutorial
Video by GoliTech, embedded from YouTube. The written steps below are our own and match the parts list.
Mission steps
Install OpenCanary
Create a virtual environment and pip install opencanary.
Create the config
opencanaryd --copyconfig writes a sample config; enable a few services such as FTP, HTTP and SMB-like shares.
Choose alerts
Configure logging to a file plus a webhook or email handler so alerts reach your phone.
Run it
opencanaryd --start. Give the Pi a boring hostname like nas-backup.
Test it yourself
From your laptop, try to open the fake HTTP login page and confirm you get an alert.
Code
sudo apt install -y python3-dev libssl-dev libffi-dev build-essential
python3 -m venv ~/canary && source ~/canary/bin/activate
pip install opencanary
opencanaryd --copyconfig # creates /etc/opencanaryd/opencanary.conf
sudo nano /etc/opencanaryd/opencanary.conf
opencanaryd --startTip: test every script on the bench before installing it in a moving machine.
Questions
Will it slow down my network?
No. It just sits and listens. A Pi Zero 2 W is plenty.