To clarify it all :-
1. How nobody user came in your system?
Nobody user is a pseudo user created by default on a fresh install in many Linux and Unixes distributions
2. Who is nobody user ?
"Nobody" user has the least permissions on the system.
It owns no files, is in no privileged groups, and has no abilities except those which every other user has.
Nobody user has no shell assigned to it.
~$ sudo grep nobody /etc/passwd
3. What is the purpose of nobody user ?
In early Unix and Linux Distributions, it was common to run daemons (for example a webserver) under nobody user to limit the damage to the rest of the system, so that If a malicious user gained control over such a daemon, he do not have access to any file or privileged rights.
But the problem is, when there are multiple daemons running with the nobody user, this has no sense anymore. That's why today such daemons have their own user.
4. How nobody user logged in on your system ?
You might have some service/daemon running which runs under nobody user.
Some examples of services can be: httpd, nfs, postfix , etc
5. What are the two processes running on your system under nobody user ?
- systemd --user instance that is started when a user first logs in ( in your case it is the nobody user )
- (if pam_systemd is enabled), systemd starts a subprocess "(sd-pam)" that opens a PAM session for the user, using the "systemd-user" service name.
6. Why are the processes ( systemd and sd-pam ) still there , even when the service that ran under nobody user is not running anymore ?
Well this has been reported as a bug where
Systemd-user doesn't properly close its PAM session.
Systemd is not able to close pam session properly because sd-pam subprocess drops privileges after pam_open_session(). So pam_close_session() runs as the user rather than as root which breaks PAM modules that need to do privileged tasks to clean up the session.
For more information on this: