Logwatch error or possible crack attempt?

[Jeff Vian]

On Sat, 2004-09-25 at 14:51, Lorn Miller wrote:
> Logwatch for Sep 22
>  --------------------- pam_unix Begin ------------------------ 
> 
> <cut>
> 
> vsftpd:
>    Unknown Entries:
>       authentication failure; logname= uid=0 euid=0 tty= ruser=
> rhost=80.141.233.183 : 16 Time(s)
>       check pass; user unknown: 16 Time(s)
> 
> 
>  ---------------------- pam_unix End ------------------------- 
> 
This is an attempt to connect to ftp from 80.141.233.183 and says that
the connection failed because of username/password problems.

If this is not your machine, then someone else is trying to connect.

Check /var/log/vsftpd.log for entries related to this IP.

> 
> Is there a local process that would do that or did someone try to get
> into my ftp server 16 times?  Where could I check to see if they
> succeeded?
>