password sniffingj

[Tracy R Reed <treed () ultraviolet org>]

Are there snort rules which will detect passwords being sent in cleartext?
I am interested in catching any passwords being sent in the clear in a
number of protocols (http, pop, imap, etc). It is against corporate policy
to send passswords in the clear but we have no way of knowing whether a
developer has done something silly like set up non-ssl http authentication
on some web server somewhere. I suppose I could run linsniff but it would
be nice to have something integrated with snort that supported more
protocols.

-- 
Tracy Reed      http://www.ultraviolet.org
"Every artist is a cannibal, every poet is a thief.
 They all kill their inspiration, and sing about the grief." - U2

Attachment: _bin
Description: