3

This was in a recent Tripwire report of a Debian Linux (virtual) server: 

### Attr        Observed (what it is)         Expected (what it should be)
### =========== ============================= =============================
/dev/char/253:0
    md5 (sig1): 3cArKelJk8b0VTK4Q80.nV        3Z4Cv6zdER0tKfg3lDqPM3

First of all, what is /dev/char/253:0? Secondly, should I be concerned that it changed?

UPDATE. One of my colleagues said that this can happen with a server reboot, which, since I had rebooted the server the previous day, is probably what triggered the Tripwire alert.

user35042
  • 2,601
  • 10
  • 32
  • 57

1 Answers1

2

The /dev folder is where linux stores files generally associated with devices. Most of these are special files that are mapped or linked with individual devices, such as hard drives, cd-roms, USB devices, etc..

It would seem to me that monitoring these files for changes would result in a lot of changes being detected, depending on the device and how the file is used. I haven't worked with a /char directory too frequently, but I believe it contains "Character Devices," which are characterwise/steraming interfaces, as opposed to block devices, such as hard drives and CD-ROMs.

To answer your question, I would think you could safely disregard this message, after verifying that whatever device is mapped to 253:0 is expected.

For more information, check out:

http://tldp.org/LDP/sag/html/dev-fs.html

and

http://en.wikipedia.org/wiki/Device_file#Character_devices

Univ426
  • 2,139
  • 14
  • 26
  • You said "verifying that whatever device is mapped to 253:0 is expected". How do I find out what that device is? (The server is a virtual machine.) – user35042 Jun 20 '12 at 20:54
  • Unfortunately, I'm not sure. I'm mostly used to working with RedHat/CentOs, and I've never seen the /char directory pop up in the /dev folder, nor do I know how Debian maps streaming devices (although 253:0 definitely looks like some sort of mapping). You could do a grep on /var/log/messages, see if that "253:0" pops up anywhere. I just saw your update though, and that definitely sounds possible, again, depending on what device is associated with that file, and how the device uses the file. – Univ426 Jun 21 '12 at 13:07