The only log entries that appear when a different user tries it do
appear in /var/log/secure:
Nov 6 10:33:19 ws102317180 sshd[24003]: Invalid user
an_ad_user(a)bau.mydomain.at from 10.16.11.218 port 60646
Nov 6 10:33:19 ws102317180 sshd[24003]: input_userauth_request: invalid
user an_ad_user(a)bau.mydomain.at [preauth]
Nov 6 10:33:19 ws102317180 sshd[24003]: Postponed keyboard-interactive
for invalid user an_ad_user(a)bau.mydomain.at from 10.16.11.218 port 60646
ssh2 [preauth]
Nov 6 10:33:26 ws102317180 sshd[24005]: pam_unix(sshd:auth): check
pass; user unknown
Nov 6 10:33:26 ws102317180 sshd[24005]: pam_unix(sshd:auth):
authentication failure; logname= uid=0 euid=0 tty=ssh ruser=
rhost=somehost.bau.mydomain.at
Nov 6 10:33:28 ws102317180 sshd[24003]: error: PAM: User not known to
the underlying authentication module for illegal user
an_ad_user(a)bau.mydomain.at from somehost.bau.mydomain.at
Nov 6 10:33:28 ws102317180 sshd[24003]: Failed keyboard-interactive/pam
for invalid user an_ad_user(a)bau.mydomain.at from 10.16.11.218 port 60646
ssh2
Nov 6 10:33:28 ws102317180 sshd[24003]: Postponed keyboard-interactive
for invalid user an_ad_user(a)bau.mydomain.at from 10.16.11.218 port 60646
ssh2 [preauth]
Nov 6 10:33:38 ws102317180 sshd[24006]: pam_unix(sshd:auth): check
pass; user unknown
Nov 6 10:33:38 ws102317180 sshd[24006]: pam_unix(sshd:auth):
authentication failure; logname= uid=0 euid=0 tty=ssh ruser=
rhost=somehost.bau.mydomain.at
Nov 6 10:33:39 ws102317180 sshd[24003]: error: PAM: User not known to
the underlying authentication module for illegal user
an_ad_user(a)bau.mydomain.at from as03184.bau.mydomain.at
Nov 6 10:33:39 ws102317180 sshd[24003]: Failed keyboard-interactive/pam
for invalid user an_ad_user(a)bau.mydomain.at from 10.16.11.218 port 60646
ssh2
Nov 6 10:33:39 ws102317180 sshd[24003]: Postponed keyboard-interactive
for invalid user an_ad_user(a)bau.mydomain.at from 10.16.11.218 port 60646
ssh2 [preauth]