Exploration of OpenCanary
Opencanary is an open source honeypot tool that detects and alerts about potential intrusion
attempts. It runs on canary services that serve as protocols, such as FTP, HTTP, SSH, and SMB,
to attract and detect malicious activities. These alerts can be sent to various sources, such as
emails, Syslog, and the Correlator owned by OpenCanary. Opencanary supports native faking for
various server personalities like Linux Web Server, Windows Server, MySQL Server, and
MSSQL Server.
Opencanary configuration enables different ports serving various software. Linux Web Server
Configuration enables Port 21, which serves the File Transfer Protocol (FTP), Port 80 (Hypertext
Transfer Protocol), which serves Apache Apache/2.2.22 (Ubuntu), and Port 8022 (openSSH) that
serves the software SSH-2.0-OpenSSH_5.1p1 Debian-4. The Windows Server configuration
enables Port 445, which serves the SMB server. MySQL Server ports include Port 3306 for
software MySQL version 5.5.43-0ubuntu0.14.041, a database management system, and Port 22
for SSH (OpenSSH) version SSH-2.0-OpenSSH_5.1p1 Debian-4, a secure remote access
protocol. MSSQL Server port 1433 serves Microsoft SQL Server 2012, a relational database
system, and port 3389, a remote desktop protocol.
I would set OpenCanary in email alerts using a series of steps detailed below: Create a virtual
environment (machine) within my network where I would install the OpenCanary and then
configure a logger with necessary variables like mail host, from address, to address, subject,
credentials, and secure parameter. I would set up an app password and use credentials, including
empty tuple for the secure parameter. I would then send it via the SMTP authentication to
manage and analyze alerts. Also, confidential information such as passwords would be passed
using environmental variables from the host machine to the application. I would receive alerts in
the preferred email address whenever there is an intrusion.
