- Home
- Honeypot Software
- Heralding
Heralding
What it is
Heralding is a free, self-hosted network honeypot for collecting credentials. It runs on Linux and supports FTP, Telnet, SSH, HTTP, HTTPS, POP3, POP3S, IMAP, IMAPS, SMTP, VNC, PostgreSQL and SOCKS5. When a protocol makes them available, its authentication log records usernames and plaintext passwords. It also saves authentication attempts, session summaries and full session data in CSV and JSON Lines files. Session records can include timestamps, duration, source and destination IP addresses and ports, protocol, authentication attempts and protocol-specific details. Session log entries are written after a session ends; authentication entries appear when a password has been transmitted. Installation instructions describe pip on Debian-based systems and Docker deployment with port mapping. The project requires Python 3.7.0 or higher and is licensed under GPL-3.0. For separate packet captures per session, the README points to Curisoum and says to enable it in Heralding.yml.
For and against
For
- Free and GPL-3.0 licensed.
- Supports a wide range of network protocols.
- Writes session data to CSV and JSON Lines.
- Can run through pip or Docker.
Against
- Requires Python 3.7.0 or higher.
- Self-hosted Linux deployment is required.
- Passwords are recorded in plaintext when protocols provide them.
The verdict
Heralding offers broad protocol coverage and detailed credential and session logging for self-hosted Linux use. Its setup requires Python 3.7.0 or higher, and password capture depends on what a protocol makes available.
Who it suits
Heralding suits Linux users who want to collect credentials in a self-hosted network honeypot. Its logs may be useful to users who need session summaries and detailed connection data.
Plans and prices
Heralding
GPL-3.0 licensed open-source honeypot
Read 3 Oct 2026 · github.com
On the record
- Authentication capture
- The auth log records usernames and plaintext passwords when the protocol makes them available.github.com · read 3 Oct 2026
- Container deployment
- The project README describes building a Docker image and running it with a port mapping.github.com · read 3 Oct 2026
- Installation
- The README gives pip installation instructions and describes running Heralding on a Debian-based system.github.com · read 3 Oct 2026
- Intended users
- The project describes itself as a honeypot for users who want to collect credentials.github.com · read 3 Oct 2026
- License
- GitHub identifies the project as GPL-3.0 licensed.github.com · read 3 Oct 2026
- Log timing
- Session log entries are written after a session ends, while auth log entries appear when a password has been transmitted.github.com · read 3 Oct 2026
- Packet capture
- The README points to Curisoum for creating a separate PCAP for each Heralding session and says to enable it in Heralding.yml.github.com · read 3 Oct 2026
- Protocols
- It supports FTP, Telnet, SSH, HTTP, HTTPS, POP3, POP3S, IMAP, IMAPS, SMTP, VNC, PostgreSQL and SOCKS5.github.com · read 3 Oct 2026
- Purpose
- Heralding is a simple honeypot that collects credentials.github.com · read 3 Oct 2026
- Requirements
- The README states that Python 3.7.0 or higher is required.github.com · read 3 Oct 2026
- Session details
- Session data can include timestamps, duration, source and destination IP and port, protocol, authentication attempts and protocol-specific auxiliary data.github.com · read 3 Oct 2026
- Session logs
- It writes authentication attempts, session summaries and complete session data to CSV and JSON Lines files.github.com · read 3 Oct 2026
