2

Whenever I am installing something, like ghost, nginx, mysqld I see commands such as,

useradd ghost 
useradd mysql

What is the reason for this? I can guess this may help categorize some software for giving different users different privileges, or the software access restraints, but I don't understand the whole picture. Can someone explain a little bit, as to what benefits useradd mysql gives?

1
  • It does help categorize things but that's not why it is so (see the part of Ramesh's answer that deals with security).
    – goldilocks
    Oct 24, 2014 at 16:58

1 Answer 1

5

It is there for an obvious reason. To quote from this answer,

When you are creating an account to run a daemon, service, or other system software, rather than an account for interactive use.

Technically, it makes no difference, but in the real world it turns out there are long term benefits in keeping user and software accounts in separate parts of the numeric space.

Mostly, it makes it easy to tell what the account is, and if a human should be able to log in.

A lot of unix/linux security depends on access to files and the right to execute them, and this is managed through user accounts.

So programs need a user account in order to work.

It's common to create a specific account for each application/service/daemon because this gives fine-grained control about what the program is allowed to do (eg don't mess with other programs' files)

However, the main reason to maintain the different system accounts is the compartmentalization for the purpose of security as noted by goldilocks from his comments. As he points out, since the web services are outward facing, the security is an important aspect and the system accounts help in achieving it.

References

http://ubuntuforums.org/showthread.php?t=1146686

4
  • 2
    The quote from the server fault answer, re: "keeping user and software accounts in separate parts of the numeric space" is sort of tangential to the question (and perhaps confusing, if you are not aware of this distinction). Anyway, the primary reason is certainly compartmentalization for the purpose of security. You might want to mention the fact that since web services are outward facing, this is particularly important for them.
    – goldilocks
    Oct 24, 2014 at 16:57
  • @goldilocks, thanks. I updated the answer. Please feel free to edit if you think some information is missing.
    – Ramesh
    Oct 24, 2014 at 17:00
  • So if I use chmod to make my file foo writable by only me (the owner), and then I use sudo to run a program bar as a different user, then bar can't write to my file foo? Even if the author of bar were the greatest hacker ever and wrote bar in C or assembly language, or even in machine code? Even then bar still wouldn't be able to write to my file foo?
    – ma11hew28
    May 2, 2020 at 16:15
  • @ma11hew28 I'm pretty sure if you used sudo, then bar can do whatever it wants. Jul 19, 2022 at 14:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .