The file /var/log/btmp should not be readable by non-root:

If someone is typing the password when the user was expected, the failed login will be documented in btmp. Probably user will login correct soon. So you have a combination of user (wtmp / last) and password (btmp / lastb).

Therefore the system denies to write into btmp because of bad permissions.

/var/log/messages:
Mar 23 08:52:21 ipfire sshd[31548]: Failed password for root from 1.2.3.4 port 63320 ssh2
Mar 23 08:52:21 ipfire sshd[31548]: Excess permission or bad ownership on file 

ls -l /var/log/btmp
-rw-r--r-- 1 root root 0 Feb  1 22:51 /var/log/btmp

should be
-rw------- 1 root root 0 Feb  1 22:51 /var/log/btmp