Look in auth.log since riemann1 is an Ubuntu system.