(unknown :0           :0               Tues Jul  4 06:51 - 06:51  (00:00)

# grep --color=auto -A 10 -B 10 "unknown|Unknown" auth.log.*

auth.log.1-Jul  4 06:51:41 magic gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user Debian-gdm by (uid=0)
auth.log.1-Jul  4 06:51:41 magic systemd-logind[3291]: New session c1 of user Debian-gdm.
auth.log.1-Jul  4 06:51:41 magic systemd: pam_unix(systemd-user:session): session opened for user Debian-gdm by (uid=0)
auth.log.1-Jul  4 06:51:42 magic CRON[3329]: pam_unix(cron:session): session closed for user logcheck
auth.log.1-Jul  4 06:51:42 magic polkitd(authority=local): Registered Authentication Agent for unix-session:c1 (system bus name :1.21 [gnome-shell --mode=gdm], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)
auth.log.1-Jul  4 06:51:52 magic gdm-password]: pam_unix(gdm-password:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=  user=user
auth.log.1:Jul  4 06:52:03 magic gdm-password]: pam_unix(gdm-password:session): session opened for user user by (unknown)(uid=0)
auth.log.1-Jul  4 06:52:03 magic systemd-logind[3291]: New session 3 of user user.
auth.log.1-Jul  4 06:52:03 magic systemd: pam_unix(systemd-user:session): session opened for user user by (uid=0)
auth.log.1-Jul  4 06:52:03 magic polkitd(authority=local): Unregistered Authentication Agent for unix-session:c1 (system bus name :1.21, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) (disconnected from bus)
auth.log.1-Jul  4 06:52:04 magic polkitd(authority=local): Registered Authentication Agent for unix-session:3 (system bus name :1.47 [/usr/bin/gnome-shell], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.utf8)
auth.log.1-Jul  4 06:55:58 magic gnome-keyring-daemon[5159]: couldn't allocate secure memory to keep passwords and or keys from being written to the disk

Port 222
ListenAddress 127.127.127.127:222
Protocol 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
# Insecure ancient DSA
#HostKey /etc/ssh/ssh_host_dsa_key
# Not certain whether we ought to trust elliptic curve or NIST
#HostKey /etc/ssh/ssh_host_ecdsa_key
UsePrivilegeSeparation yes
# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 4096
SyslogFacility AUTH
LogLevel INFO
LoginGraceTime 90
PermitRootLogin no
StrictModes yes
# Never use this deprecated crap
RSAAuthentication no
PubkeyAuthentication yes
# lock down to this group
AllowGroups ssh-users
AuthorizedKeysFile  %h/.ssh/authorized_keys
IgnoreRhosts yes
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes
# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no
ChallengeResponseAuthentication no
PasswordAuthentication no
X11Forwarding no
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
AcceptEnv LANG LC_*
# extra logging info for sftp
Subsystem sftp /usr/lib/openssh/sftp-server -f auth -l info
UsePAM yes
# hardened ciphering
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com
KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr