Hopefully your distro documents what its default users and groups are for. For example, Debian ships
/usr/share/doc/base-passwd/users-and-groups.* which explains the ones on Debian. A quick search for inurl:"doc/base-passwd" found a few places with a copy online (intentional or not); here is one.
Basically they don't know why there is
bin user, LSB says to include one for legacy reasons.
These users typically are "locked", so they can't be logged in to. Though root can switch to one of them using
su (or the equivalent system calls), which is how daemons run as them.
You can look for any files owned by a user with
find / -user USER_NAME
There are basically a few uses for the built-in users and groups:
- Permit access to certain special files (e.g., /dev files for attached printers being owned by the group
lp). Then daemons (such as CUPS) can be members of that group to gain access. This can be targeted at users, too. For example, on Debian, adding a user to the
adm group lets him/her view system log files.
- Isolation. Two programs running as the same user are allowed to interact with each other, e.g., to send each other signals and even, depending on some kernel settings,
ptrace each other (
ptrace is how a debugger works, and basically allows you complete control over the target process). Examples include
- Access control. E.g., on Debian, there is an
lpadmin group used by CUPS. If you add a user to this group, they're allowed to administer CUPS via the web interface.
The first two are probably the most common.
PS: Instead of
cat /etc/group, you probably want to use
getent passwd and
getent groups. Those will work on systems configured with alternate password/group stores, such as LDAP.