Спасибо, нашёл, к тому же что кто-то в SSH постоянно пытается доступ наловить...
Но вот кто учётную запись создал, я всё таки не пойму.
Nov 14 13:41:54 Ownhost sshd[8106]: Invalid user oracle from 123.255.248.69
Nov 14 13:41:54 Ownhost sshd[8106]: pam_unix(sshd:auth): check pass; user unknown
Nov 14 13:41:54 Ownhost sshd[8106]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.255.248.69
Nov 14 13:41:54 Ownhost sshd[8106]: pam_winbind(sshd:auth): getting password (0x00000388)
Nov 14 13:41:54 Ownhost sshd[8106]: pam_winbind(sshd:auth): pam_get_item returned a password
Nov 14 13:41:55 Ownhost groupadd[8111]: group added to /etc/group: name=login7, GID=1002
Nov 14 13:41:56 Ownhost groupadd[8111]: group added to /etc/gshadow: name=login7
Nov 14 13:41:56 Ownhost groupadd[8111]: new group: name=login7, GID=1002
Nov 14 13:41:56 Ownhost useradd[8115]: new user: name=login7, UID=1002, GID=1002, home=/home/login7, shell=/bin/bash
Nov 14 13:41:56 Ownhost passwd[8122]: pam_smbpass(passwd:chauthtok): Failed to find entry for user login7.
Nov 14 13:41:56 Ownhost passwd[8122]: eCryptfs PAM passphrase change module retrieved a NULL passphrase; nothing to do
Nov 14 13:41:57 Ownhost sshd[8106]: Failed password for invalid user oracle from 123.255.248.69 port 45841 ssh2
Nov 14 13:42:03 Ownhost passwd[8122]: pam_unix(passwd:chauthtok): password changed for login7
Nov 14 13:42:03 Ownhost passwd[8122]: pam_smbpass(passwd:chauthtok): Failed to find entry for user login7.
Nov 14 13:42:03 Ownhost passwd[8122]: gkr-pam: couldn't update the login keyring password: no old password was entered
Nov 14 13:42:03 Ownhost passwd[8122]: Error attempting to parse .ecryptfsrc file; rc = [-13]
Nov 14 13:42:03 Ownhost passwd[8122]: Passphrase file wrapped
Nov 14 13:42:03 Ownhost passwd[8122]: eCryptfs PAM passphrase change module retrieved at least one NULL passphrase; nothing to do
Nov 14 13:42:04 Ownhost sshd[8123]: Invalid user amanda from 123.255.248.69
Nov 14 13:42:04 Ownhost sshd[8123]: pam_unix(sshd:auth): check pass; user unknown
Nov 14 13:42:04 Ownhost sshd[8123]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.255.248.69
Nov 14 13:42:04 Ownhost sshd[8123]: pam_winbind(sshd:auth): getting password (0x00000388)
Nov 14 13:42:04 Ownhost sshd[8123]: pam_winbind(sshd:auth): pam_get_item returned a password
Nov 14 13:42:05 Ownhost chfn[8125]: changed user 'login7' information
Nov 14 13:42:07 Ownhost sshd[8123]: Failed password for invalid user amanda from 123.255.248.69 port 45976 ssh2
Nov 14 13:42:07 Ownhost sshd[7967]: pam_unix(sshd:session): session closed for user root
Nov 14 13:42:11 Ownhost sshd[8131]: Invalid user postgres from 123.255.248.69
Nov 14 13:42:11 Ownhost sshd[8131]: pam_unix(sshd:auth): check pass; user unknown
Nov 14 13:42:11 Ownhost sshd[8131]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.255.248.69