Thank you for ure reply..!
yes, my system is mostly standard sarge, so it uses PAM for authentication.
Here's the thing: I find it strang that when I:
cat /var/log/auth.og | grep samson
I never get entries that have been recorded in the log for this name. Yet the names 'sam' 'sams' , etc. appear many times in the logs as 'Illegal' users. So I wonder if the scans are actually trying 'samson' and I just do not know about it.
Thing is this occurred also for 'root' - ie: i never got logs for scans that tried 'root'. Yet when i restricted all users xcept one, within sshd.conf, root began appearing in the logs, so I know this name (obviously) was being tried. Therefore, I am worried that the names appearing in /etc/passwd do not appear in the logs, in my system, as 'invalid users', and thusly I'll never see when they are being tried with invalid passwords. (i hope this makes sense).
I just again tested, and can see that when I attempted to log on to 'samson' (assume that this user is in /etc/passwd) with a bad password, there is indeed a log (three times) for bad password (this is from PAM). Perhaps the scans are using a different login method, one that does not automatically log into /var/log/auth.log.
... sigh... ... anyhow thanks!...