Why does Kali Linux have other existing users from /etc/passwd file? I never created these users

Question

I simply wanted to see my user that I just created in the terminal but I came across this sea of users in my existing Kali Linux vm. The command I used displayed a list of users. It started with "root" (me) and ended with "Homer" (the user I just created). The list is extensive and includes users such as "root, Daemon, nobody, tss, king-phisher, systemd-coredump, rtkit, sshd, stunnel4, mysql, Homer." I understand that each entry with a User ID (UID's) from 1 - 99 and 100 - 999 are reserved for predefined accounts and reserved by sys administrative groups. However, a few are users with encrypted passwords and their User Id (UID) is 1000+ with a command shell of /bin/bash and /sbin/nologin. I referred to this blog: https://www.cyberciti.biz/faq/understanding-etcpasswd-file-format/

A newbie here so I'm probably not asking it the best way possible. But, I would like to know why these accounts exist and if they are somehow influenced when I downloaded Kali (predetermined)? Specifically, the entry with user "nobody" and "corrkid" seemed too suspicious. I will post their entry below with root (me) and Homer (user I created) for comparison.

I opened the list in Kali with:

root@kali:~# cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
redsocks:x:109:114::/var/run/redsocks:/usr/sbin/nologin
rwhod:x:110:65534::/var/spool/rwho:/usr/sbin/nologin
iodine:x:111:65534::/var/run/iodine:/usr/sbin/nologin
miredo:x:112:65534::/var/run/miredo:/usr/sbin/nologin
corrkid:x:1000:1000:corrkid,,,:/home/corrkid:/bin/bash
Homer:x:1001:1001::/home/Homer:/bin/sh

My version of Kali Linux is (This might be useful information?):

# Kali GNU/Linux Rolling 
Version: "2020.3"
ID_LIKE=debian

Thanks in advance

Answer 1

The default contents of /etc/passwd in Kali are inherited from Debian, and you’ll see root and nobody defined there along with a few other accounts.

The accounts with ids just above 100 correspond to system users created by packages, e.g. redsocks or miredo.

The only suspicious accounts are corrkid and Homer. Given its id (1000), corrkid is the account created during installation, in these two screens:

Homer as you mention is the user you just created, with a somewhat unusual setup involving /bin/sh rather than /bin/bash.