Hopefully your distro documents what its default users and groups are for. For example, Debian ships /usr/share/doc/base-passwd/users-and-groups.*
which explains the ones on Debian. A quick search for inurl:"doc/base-passwd" found a few places with a copy online (intentional or not); here is one.
Basically they don't know why there is bin
user, LSB says to include one for legacy reasons.
These users typically are "locked", so they can't be logged in to. Though root can switch to one of them using su
(or the equivalent system calls), which is how daemons run as them.
You can look for any files owned by a user with find / -user USER_NAME
There are basically a few uses for the built-in users and groups:
- Permit access to certain special files (e.g., /dev files for attached printers being owned by the group
lp
). Then daemons (such as CUPS) can be members of that group to gain access. This can be targeted at users, too. For example, on Debian, adding a user to the adm
group lets him/her view system log files.
- Isolation. Two programs running as the same user are allowed to interact with each other, e.g., to send each other signals and even, depending on some kernel settings,
ptrace
each other (ptrace
is how a debugger works, and basically allows you complete control over the target process). Examples include gdm
, syslog
, etc.
- Access control. E.g., on Debian, there is an
lpadmin
group used by CUPS. If you add a user to this group, they're allowed to administer CUPS via the web interface.
The first two are probably the most common.
PS: Instead of cat /etc/passwd
/cat /etc/group
, you probably want to use getent passwd
and getent groups
. Those will work on systems configured with alternate password/group stores, such as LDAP.