Logwatch shows that proftpd was tried to be logged into using root
0.0.0.0 (126.96.36.199[188.8.131.52]) - SECURITY VIOLATION: Root login attempted
Normally, proftpd does not allow root logins under any circumstance. If a client attempts to login as root, using the correct password, a special security message is logged: SECURITY VIOLATION: Root login attempted
login as root, using the correct password. How do I find out which password the hacker knows?