is there anything interesting in /sys/log/auth and have you tried auth/debug?