I just learning about daemon, by that time I came know avahi daemon can you please explain detaily about avahi daemon and why linux has a avahi user ?
In short: avahi is a Linux implementation of a protocol also known as "Rendezvous" or "Bonjour"). Its goal is to let devices, connected to the local network, broadcast their IP-address together with their function. Hence the printer can from time to time broadcasts : My IP is
192.168.23.45 and I can print any postscript document with ipp prottocol; a NAS can say: My IP is
192.168.23.88 and I can stream music, save your backups, and act as a fileserver.
If it is not what you want to hear on your network you can stop / disable the avahi daemon with the standard
systemctl command, but if you run a cups-broadcast daemon, it will start the avahi itself.
Linux uses fictive users usually for security reasons, not to give the attacker any chance to hack a process owned by root. So you can see a
mysql users. The daemon, owned by such unprivileged user, gives less chance for the attacker to get the superuser rights.
AFAIK: avahi/bonjour/rendezvous service need cooperation of all devices. Each device is announcing its service by several broadcast per minut, while your computer with avahi daemon running/listening keeps a collection of available services. If you stop the avahi daemon on your computer but all devices continue with their advertisement, the list of services can be quickly rebuild, after you start avahi daemon again. But if you somehow force all the device to stop broadcasting of their "rendezvous" info, even the running avahi daemon does have nothing to collect, hence the easy config will not be possible. Yes, there are some other ways how to keep the knowlidge about services, available in your reach, e.g. port scanning, local DNS, etc. The avahi way is very easy and it has a growing support. It is your deal to decide which way to follow.
This was compilled from my and telcoM's comments and Internet.
Dripping faucets are annoying even if we all need running water. I don't use mDns, so I've deleted it without incident (apt-get --purge remove avahi-daemon). Further information about disabling it can be found here: https://www.stigviewer.com/stig/red_hat_enterprise_linux_6/2020-09-03/finding/V-218006