Cosa dice /var/log/auth?