I simply wanted to see my user that I just created in the terminal but I came across this sea of users in my existing Kali Linux vm. The command I used displayed a list of users. It started with "root" (me) and ended with "Homer" (the user I just created). The list is extensive and includes users such as "root, Daemon, nobody, tss, king-phisher, systemd-coredump, rtkit, sshd, stunnel4, mysql, Homer." I understand that each entry with a User ID (UID's) from 1 - 99 and 100 - 999 are reserved for predefined accounts and reserved by sys administrative groups. However, a few are users with encrypted passwords and their User Id (UID) is 1000+ with a command shell of /bin/bash and /sbin/nologin. I referred to this blog: https://www.cyberciti.biz/faq/understanding-etcpasswd-file-format/

A newbie here so I'm probably not asking it the best way possible. But, I would like to know why these accounts exist and if they are somehow influenced when I downloaded Kali (predetermined)? Specifically, the entry with user "nobody" and "corrkid" seemed too suspicious. I will post their entry below with root (me) and Homer (user I created) for comparison.

I opened the list in Kali with:

root@kali:~# cat /etc/passwd

My version of Kali Linux is (This might be useful information?):

# Kali GNU/Linux Rolling 
Version: "2020.3"

Thanks in advance

  • 3
    Half of those are NSA
    – Pourko
    Nov 2, 2020 at 20:39
  • What do you mean by "too sus"? I've not come across this phrase Nov 2, 2020 at 22:55
  • @roaima sus is an abbreviation for "suspicious" read "Specifically the entry with user "nobody" and "corrkid" seemed suspicious" Nov 2, 2020 at 23:30
  • Thank you @PhilipCouling. Never heard that one before Nov 3, 2020 at 7:00

1 Answer 1


The default contents of /etc/passwd in Kali are inherited from Debian, and you’ll see root and nobody defined there along with a few other accounts.

The accounts with ids just above 100 correspond to system users created by packages, e.g. redsocks or miredo.

The only suspicious accounts are corrkid and Homer. Given its id (1000), corrkid is the account created during installation, in these two screens:

Kali user account creation, step 1 (full name of the user)

Kali user account creation, step 2 (username)

Homer as you mention is the user you just created, with a somewhat unusual setup involving /bin/sh rather than /bin/bash.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .