OpenCanary Honeypot on Ubuntu 24.04 LTS

OpenCanary is a lightweight, low-interaction honeypot daemon from Thinkst that stands up a set of decoy network services and raises an alert the moment anyone touches them. Because nothing legitimate should ever connect to a decoy, every interaction is a high-signal, low-noise indicator of reconnaissance or compromise on your network. It is one of the most widely deployed open source honeypots for early breach detection and threat intelligence. This image delivers OpenCanary fully installed and running as a managed systemd service within minutes of launch, with no manual Python packaging, no virtualenv wrangling and no configuration required to get useful alerts.

Security is designed in from the first boot. The decoy services - FTP, HTTP, Telnet, MySQL and a decoy SSH on a dedicated high port - are cleanly separated from the operating system's own SSH, which stays key-only for your real administrative access with no image-baked password and no shared bootstrap credential. On each virtual machine's first boot the appliance mints a fresh, unique alert node identity, so no two deployments share a fingerprint and the image gives away nothing about its origin. Systemd manages the service for automatic restart and clean, structured logging.

Every decoy interaction is written to a structured JSON alert log, ready to forward to your SIEM, to email, to a webhook or to syslog. Because the decoys are emulated and never expose the real system, you gain rich, safe visibility into who is probing your infrastructure and how, without the noise of a production service. 24/7 cloudimg support is included.

This is a repackaged open source software product with additional charges for cloudimg support services. OpenCanary is distributed under the BSD 3-Clause license and is a trademark of its respective owner. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.