# Postfix scenrios - SASL LOGIN authentication failed

**URL:** <https://discourse.crowdsec.net/t/postfix-scenrios-sasl-login-authentication-failed/1099>\
**Category:** crowdsec\
**Created:** [January 10, 2023, 11:34am UTC](https://discourse.crowdsec.net/t/postfix-scenrios-sasl-login-authentication-failed/1099 "2023-01-10T11:34:11Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![toz](https://avatars.discourse-cdn.com/v4/letter/t/eb9ed0/32.png) [@toz](https://discourse.crowdsec.net/u/toz)\
**Post date:** [January 10, 2023, 11:34am UTC](https://discourse.crowdsec.net/t/postfix-scenrios-sasl-login-authentication-failed/1099/1 "2023-01-10T11:34:11Z")

</div>

I am wondering if CrowdSec is currently covering the _“SASL LOGIN authentication failed”_ scenario. I have read this thread (one year old) [New install, postfix / IMAP](https://discourse.crowdsec.net/t/new-install-postfix-imap/45) and it appears that Fail2Ban does but Crowdsec not yet?

In any case, I have the postfix scenarios installed but my log is full of authentication attempts, with individual IPs trying 20 times and more.

> postfix/submission/smtpd[1994969]: warning: unknown[141.98.10.106]: SASL LOGIN authentication failed:

As a workaround a created a script which filters out those IPs followed by

> cscli decisions add --ip $ip

Should Crowdsec catch these already? If not, any plans?

---

<div class="post-metadata">

**Author:** ![toz](https://avatars.discourse-cdn.com/v4/letter/t/eb9ed0/32.png) [@toz](https://discourse.crowdsec.net/u/toz)\
**Post date:** [January 16, 2023, 2:37pm UTC](https://discourse.crowdsec.net/t/postfix-scenrios-sasl-login-authentication-failed/1099/2 "2023-01-16T14:37:12Z")

</div>

Closed with [Discord](https://discord.com/channels/921520481163673640/1064543764380655707)

---

<div class="post-metadata">

**Author:** ![cybermcm](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/cybermcm/32/568_2.png) [@cybermcm](https://discourse.crowdsec.net/u/cybermcm)\
**Post date:** [March 24, 2023, 10:41am UTC](https://discourse.crowdsec.net/t/postfix-scenrios-sasl-login-authentication-failed/1099/3 "2023-03-24T10:41:02Z")

</div>

@toz: I have the same issue, followed the discourse discussion, but I do not get the solution. Is there any?

---

<div class="post-metadata">

**Author:** ![blu-IT](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/blu-it/32/461_2.png) [@blu-IT](https://discourse.crowdsec.net/u/blu-IT)\
**Post date:** [April 4, 2023, 8:33am UTC](https://discourse.crowdsec.net/t/postfix-scenrios-sasl-login-authentication-failed/1099/4 "2023-04-04T08:33:38Z")

</div>

Tried to look for the solution on Discord, following the link says: “You are on a strange place…” Well something lilke, the post ist not found.

Can someone help or paste the solution here? Thanks!

---

<div class="post-metadata">

**Author:** ![toz](https://avatars.discourse-cdn.com/v4/letter/t/eb9ed0/32.png) [@toz](https://discourse.crowdsec.net/u/toz)\
**Post date:** [April 4, 2023, 10:01am UTC](https://discourse.crowdsec.net/t/postfix-scenrios-sasl-login-authentication-failed/1099/5 "2023-04-04T10:01:06Z")

</div>

What I ended up doing is increasing some of the default values of the scenario.  
I can’t look it up for you right now I am afraid, as I am currently not able to log on to this horrible, blinking Discord mess.

Apparently I am logging in from a new location (which I don’t), and by the time the confirmation email arrives the token expired…

---

<div class="post-metadata">

**Author:** ![blu-IT](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/blu-it/32/461_2.png) [@blu-IT](https://discourse.crowdsec.net/u/blu-IT)\
**Post date:** [April 11, 2023, 9:16am UTC](https://discourse.crowdsec.net/t/postfix-scenrios-sasl-login-authentication-failed/1099/6 "2023-04-11T09:16:18Z")

</div>

@toz

Thanks, I appreciate your help! Maybe it is a good idea to tranfer the solution in this place here, where it has the chance to be permanent accessible.  
I found only this and another post regarding “postfix-sasl” and this post here provides a solution that unfortunately “disapeared” 😉

---

<div class="post-metadata">

**Author:** ![Markus](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/markus/32/868_2.png) [@Markus](https://discourse.crowdsec.net/u/Markus)\
**Post date:** [May 8, 2024, 10:37am UTC](https://discourse.crowdsec.net/t/postfix-scenrios-sasl-login-authentication-failed/1099/7 "2024-05-08T10:37:33Z")

</div>

Hello friends,  
I also have the problem that servers from all over the world frequently attempt to log on to my mail server. I wanted to enquire how you have solved this problem? I can’t find a working workaround for CrowdSec.

Thanks for your help.

---

<div class="post-metadata">

**Author:** ![zogness](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/zogness/32/800_2.png) [@zogness](https://discourse.crowdsec.net/u/zogness)\
**Post date:** [October 8, 2024, 12:08am UTC](https://discourse.crowdsec.net/t/postfix-scenrios-sasl-login-authentication-failed/1099/8 "2024-10-08T00:08:00Z")

</div>

Discord is loathsome.

---

<div class="post-metadata">

**Author:** ![Cyrille37](https://avatars.discourse-cdn.com/v4/letter/c/90db22/32.png) [@Cyrille37](https://discourse.crowdsec.net/u/Cyrille37)\
**Post date:** [October 29, 2025, 3:39pm UTC](https://discourse.crowdsec.net/t/postfix-scenrios-sasl-login-authentication-failed/1099/9 "2025-10-29T15:39:02Z")

</div>

Hi @toz  
Could you please publish the solution here, I’ve no access to discord.  
Thanks & regards