lastb: /var/log/btmp empty
I think this is a problem with openssh. I tested this on an Ubuntu system and bad ssh login attempts get logged to /var/log/auth.log but not to btmp. At the console, bad login attempts do go to btmp.
In Google searches, I'm seeing reports of this going back to 2006-2007.