View source for HIDS 3358

= Description =

Simple Authentication and Security Layer (SASL) is a framework for authentication and data security in Internet protocols, such as pop3, imap, postfix, courier, other smtp servers and even web services.  Its most commonly used for mail services. 
 
This alert means that a system or user has failed to authenticate to a service that uses SASL multiple times.  This can be an indication that someone is trying to brute force attack an account, or it could mean a client has an incorrect password and/or username and keeps trying and failing to authenticate multiple times.  This specifically looks for 5 failures in 10 seconds.

== Log example ==

''Oct 8 10:33:03 host postfix/smtpd[18908]: warning: unknown[1.2.3.4]: SASL DIGEST-MD5 authentication failed: authentication failure''