i have my vsftpd running for my own puposes, and I was watching my gkrellm, for about a minute I watched the user counter go from 0 to 1 a few times then stop. I checked the log and there is nothing in it. My gf and i are the only ones that have accounts on this box, neither of us were using that port. What was that, is it a concern?

lsof -i :21

to check what's the daemon binded to :21

Ports get probed all the time if they are exposed to the Internet. How much you worry about it depends on how paranoid you are and how annoyed you'll be if you get cracked. If you leave this box on all the time I would at least have an IDS like Snort and a file monitor like Aide or Tripwire. Those can either confirm a problem or give you a bit more peace of mind. You can also run rootkit detectors like rkhunter and chkrootkit. Heck, run both of 'em. I'd also read through some of the sticky posts at the top of the Security forum. There are sections there on how to tell if you've been hacked.

thanks guys, i will check those apps out!