The price gap is the detail that caught me off guard. A commercial honeypot appliance runs about $2500, while the maker's version sits on a $35 Raspberry Pi 3 Model B+. That is a saving of $2465 for a device whose whole job is to sit unused on a network until an unauthorized scan or connection tips off the administrator. As a way to catch hackers before they become entrenched, that seems like remarkable value. The build even got compared side by side with a black commercial unit wearing a bird logo, and the DIY option holds up well in that company.
Putting it together looks refreshingly straightforward. The starter kit includes an acrylic case, a power supply and a 32GB microSD card. The Ubuntu 18.04.5 LTS image is written to the card with BalenaEtcher, then the maker logs in over SSH with the default credentials and runs system updates. OpenCanary, which is free, goes on with pip, the configuration is copied with opencanaryd --copyconfig and edited in nano, the FTP service is switched on, Gmail SMTP notification credentials are pasted in, and the daemon runs in the background from then on.
Several details stand out to me. The honeypot node is named mainftp, a scan of nearby addresses turns up open ports 21 and 22, and when an unauthorized root login is attempted, an alert email arrives within seconds, logging the source IP, timestamp, attempted login credentials and targeted port. The maker also recommends a burner email account so that real credentials are never stored on the Pi itself.
One thing remains open. The maker could not get OpenCanary running as a normal user, so it runs as root, and anyone who has managed the normal-user route is invited to say how. It is also unconfirmed whether the setup works on the original Pi or the Pi Zero, and older boards would need Raspberry Pi OS regardless, since Ubuntu 18 is incompatible with their Arm Cortex v6 processor.
Project by AnotherMaker. Watch it on their YouTube channel: