I installed the SASL in jail.local but there must be a difference in the courier*.confs with Ubuntu. Fail2ban won't even start, so I hashed them out while I look into it.
ERROR iptables -N fail2ban-sasl
iptables -A fail2ban-sasl -j RETURN
fail2ban-sasl returned 400
well. disable that one too....