Debian GNU/Linux 9.1 Stretch, ISPConfig 3.1.7p1 Is there any explanation how some of the files /usr directory tree changed owner and group? I checked sha256sum with files on another host where the files were owned by root:root and they were identical. That user is ssh jailed user, I initially suspected jailkit had something to do here. But those files are not the same that are in that users jail directories. I suppose I have to install a new server from scatch, and put tripwire there first thing.