What are all these other users (found them with top) when running Ubuntu: avahi, root, syslog, messagebus, nobody, ntp, rtkit and whoopsie. I am aware that whoopsie, for example, is for reporting errors to Canonical.

When I run 'who' I only see me (terminal and graphical display).

Why don't they all run as root or as my user name? (I suppose that they run because I as a user needs them).

  • They don't run as root for the same reason you don't (or shouldn't be) do everything as root. If a security exploit is found in one of your daemons, you dont want it having root access.
    – casey
    Jan 8, 2014 at 23:02

1 Answer 1


Most of them are system daemons and can't actually log in, they represent processes started by the init system. If you look at cat /etc/passwd, you'll see them all listed. The last field is the default shell, which may be /sbin/nologin or /bin/false indicating their lack of login possibilities. The forth field (each field is separated by an :) is a comment that may provide some information about their purpose (for more, see man 5 passwd, the 5 is important, otherwise you'll get the section 1 passwd command; section numbers are described in man man).

Daemon services1 run in the background, often as unprivileged users for security purposes -- this way undiscovered vulnerabilities can't be used to gain root access, etc. Some of them use the generic daemon user, others create their own for more secure compartmentalization.

For example, Avahi is one such daemon, for broadcast and discovery of network services (e.g. certain kinds of file sharing, I believe) on a LAN. NTP is another, for synchronizing the system clock with a WWW reference server. On Ubuntu, services such as this can be enabled/disabled via upstart (an init system developed by Canonical).

nobody is a catch-all account for things intended to operate with no privileges beyond just existing.

1. The "Notable service daemons in Unix-like systems" section of that wikipedia article contains some things from your list.

  • 1
    I'd like to warn that although nobody or nogroup are named like that, they're still as regular user and group as the others. If 2 processes run as nobody, they own the same data, especially if they're both in nogroup. Or so I read. Dec 6, 2014 at 0:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.