On my VPS, running Debian 7, I have ssh enabled on the default port 22 with only private key authentication enabled, all other ports are filtered with iptables. I am frequently getting login attempts from china under bogus usernames, such as "plesk" or "r00t", showing up in my /var/log/auth.log
The only issue is for authentication attempts that don't present a private key and attempt login under a valid username, the only line that appears in the logs reads
sshd: Connection closed by 18.104.22.168 [preauth]
When sshd logging level is set to VERBOSE, an additional line is printed stating that a user connected and the port they connected from.
Is there any way to make sshd log that it disconnected a user because they lacked a private key?