Question about entry in auth.log

[Wojciech Puchar]

> Nov 12 15:44:29 mail sshd[30160]: Accepted keyboard-interactive/pam for 
> michael from 89.123.165.3 po
> rt 55185 ssh2
>
> There is a user michael on the system, but whoever was doing this was not 
> him.
>
> I am assuming someone tried to break in using a valid username (michael) but 
> with an incorrect password.

it was VALID password. he successfully logged


change password now, look what the intruder messed and tell michael to be 
care more about his password next time.

if intruder wasn't very smart, he may not deleted .history, look what 
he/she did.