3

I have a question regarding Linux and Unix non-user service accounts. We know there are user accounts in Linux , what are (non-user) service accounts such as daemon,news, bin, etc used for?

$cat /etc/passwd | more 

reveals all the user and non-user accounts.

Why has bin has been assigned service account? Is this by design, or it serves a special purpose?

Last question

Is this true in Microsoft operating system environment( Server 2003, or 2008).?

2
  • This sure sounds like a homework question...
    – eyoung100
    Apr 29, 2014 at 15:31
  • 2
    I am a new to Linux. This is not a home-work question, as a systems administrator in MS-Windows, I am comparing MS Windows servers to Linux systems, That's why I am asking the question.
    – Ali
    Apr 29, 2014 at 15:39

2 Answers 2

2

Hopefully your distro documents what its default users and groups are for. For example, Debian ships /usr/share/doc/base-passwd/users-and-groups.* which explains the ones on Debian. A quick search for inurl:"doc/base-passwd" found a few places with a copy online (intentional or not); here is one.

Basically they don't know why there is bin user, LSB says to include one for legacy reasons.

These users typically are "locked", so they can't be logged in to. Though root can switch to one of them using su (or the equivalent system calls), which is how daemons run as them.

You can look for any files owned by a user with find / -user USER_NAME

There are basically a few uses for the built-in users and groups:

  • Permit access to certain special files (e.g., /dev files for attached printers being owned by the group lp). Then daemons (such as CUPS) can be members of that group to gain access. This can be targeted at users, too. For example, on Debian, adding a user to the adm group lets him/her view system log files.
  • Isolation. Two programs running as the same user are allowed to interact with each other, e.g., to send each other signals and even, depending on some kernel settings, ptrace each other (ptrace is how a debugger works, and basically allows you complete control over the target process). Examples include gdm, syslog, etc.
  • Access control. E.g., on Debian, there is an lpadmin group used by CUPS. If you add a user to this group, they're allowed to administer CUPS via the web interface.

The first two are probably the most common.

PS: Instead of cat /etc/passwd/cat /etc/group, you probably want to use getent passwd and getent groups. Those will work on systems configured with alternate password/group stores, such as LDAP.

2
  • The bin group was for users who were trusted enough to install programs in (most of) the standard directories such as /bin and /usr/bin. It's sort of like the "Power Users" group on older Windows systems. Apr 29, 2014 at 17:18
  • @MarkPlotnick doesn't sound too useful, as that's basically root-equivalent. Also there must have been some other use, as LSB would have no reason to require it then, as local administration is outside its scope.
    – derobert
    Apr 29, 2014 at 17:20
0

This varies from distro to distro, but, if you look closely, you'll see that the "service" accounts tend to correspond to particular processes. On my Arch linux server, I've got a user ID "ntp" that the NTP daemon runs as, a user ID "http" that Apache web server runs as, and a "postgres" user for the Postgresql database processes.

This amounts to an application of the Principle of Least Privilege. The user that runs a process should only have the minimum permissions necessary to perform its task. For example: the ntpd process should not be able to read sensitive information about the Postgres databases, and the Postgres processes shouldn't be able to rewrite the Apache config files. This helps limit problems from bugs and from deliberate compromises (exploits).

Not the answer you're looking for? Browse other questions tagged .