This was in a recent Tripwire report of a Debian Linux (virtual) server:
### Attr Observed (what it is) Expected (what it should be) ### =========== ============================= ============================= /dev/char/253:0 md5 (sig1): 3cArKelJk8b0VTK4Q80.nV 3Z4Cv6zdER0tKfg3lDqPM3
First of all, what is
/dev/char/253:0? Secondly, should I be concerned that it changed?
UPDATE. One of my colleagues said that this can happen with a server reboot, which, since I had rebooted the server the previous day, is probably what triggered the Tripwire alert.