Answer:

/var/log/auth.log