I simply wanted to see my user that I just created in the terminal but I came across this sea of users in my existing Kali Linux vm. The command I used displayed a list of users. It started with "root" (me) and ended with "Homer" (the user I just created). The list is extensive and includes users such as "root, Daemon, nobody, tss, king-phisher, systemd-coredump, rtkit, sshd, stunnel4, mysql, Homer." I understand that each entry with a User ID (UID's) from 1 - 99 and 100 - 999 are reserved for predefined accounts and reserved by sys administrative groups. However, a few are users with encrypted passwords and their User Id (UID) is 1000+ with a command shell of /bin/bash and /sbin/nologin. I referred to this blog: https://www.cyberciti.biz/faq/understanding-etcpasswd-file-format/
A newbie here so I'm probably not asking it the best way possible. But, I would like to know why these accounts exist and if they are somehow influenced when I downloaded Kali (predetermined)? Specifically, the entry with user "nobody" and "corrkid" seemed too suspicious. I will post their entry below with root (me) and Homer (user I created) for comparison.
I opened the list in Kali with:
root@kali:~# cat /etc/passwd root:x:0:0:root:/root:/bin/bash nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin redsocks:x:109:114::/var/run/redsocks:/usr/sbin/nologin rwhod:x:110:65534::/var/spool/rwho:/usr/sbin/nologin iodine:x:111:65534::/var/run/iodine:/usr/sbin/nologin miredo:x:112:65534::/var/run/miredo:/usr/sbin/nologin corrkid:x:1000:1000:corrkid,,,:/home/corrkid:/bin/bash Homer:x:1001:1001::/home/Homer:/bin/sh
My version of Kali Linux is (This might be useful information?):
# Kali GNU/Linux Rolling Version: "2020.3" ID_LIKE=debian
Thanks in advance