|
The list of default users (with a corresponding group) follows:
-
root: Root is (typically) the superuser.
-
daemon: Some unprivileged daemons that need to be able to write to some files
on disk run as daemon.daemon (portmap, atd, probably others). Daemons that
don't need to own any files can run as nobody.nogroup instead, and more complex
or security conscious daemons run as dedicated users. The daemon user is also
handy for locally installed daemons, probably.
-
bin: maintained for historic reasons.
-
sys: same as with bin. However, /dev/vcs* and /var/spool/cups are owned by
group sys.
-
sync: The shell of user sync is /bin/sync. Thus, if its password is set to
something easy to guess (such as ""), anyone can sync the system at
the console even if they have no account on the system.
-
games: Many games are sgid to games so they can write their high score files.
This is explained in policy.
-
man: The man program (sometimes) runs as user man, so it can write cat pages to
/var/cache/man
-
lp: Used by printer daemons.
-
mail: Mailboxes in /var/mail are owned by group mail, as is
explained in policy. The user and group is used for other purposes as well by
various MTA's.
-
news: Various news servers and other associated programs (such as suck) use
user and group news in various ways. Files in the news spool are often owned
by user and group news. Programs such as inews that can be used to post news
are typically sgid news.
-
uucp: The uucp user and group is used by the UUCP subsystem. It owns spool and
configuration files. Users in the uucp group may run uucico.
-
proxy: Like daemon, this user and group is used by some daemons (specifically,
proxy daemons) that don't have dedicated user id's and that need to own files.
For example, group proxy is used by pdnsd, and squid runs as user proxy.
-
majordom: Majordomo has a statically allocated uid on Debian systems for
historical reasons. It is not installed on new systems.
-
postgres: Postgresql databases are owned by this user and group. All files in
/var/lib/postgresql are owned by this user to enforce proper
security.
-
www-data: Some web browsers run as www-data. Web content should *not* be owned
by this user, or a compromised web server would be able to rewrite a web site.
Data written out by web servers, including log files, will be owned by
www-data.
-
backup: So backup/restore responsibilities can be locally delegated to someone
without full root permissions.
-
operator: Operator is historically (and practically) the only 'user' account
that can login remotely, and doesn't depend on NIS/NFS.
-
list: Mailing list archives and data are owned by this user and group. Some
mailing list programs may run as this user as well.
-
irc: Used by irc daemons. A statically allocated user is needed only because
of a bug in ircd -- it setuid()s itself to a given UID on startup.
-
gnats.
-
nobody, nogroup: Daemons that need not own any files run as user nobody and
group nogroup. Thus, no files on a system should be owned by this user or
group.
Other groups which have no associated user:
-
adm: Group adm is used for system monitoring tasks. Members of this group can
read many log files in /var/log, and can use xconsole. Historically, /var/log
was /usr/adm (and later /var/adm), thus the name of the group.
-
tty: Tty devices are owned by this group. This is used by write and wall to
enable them to write to other people's tty's.
-
disk: Raw access to disks. Mostly equivalent to root access.
-
kmem: /dev/kmem and similar files are readably by this group. This is mostly a
BSD relic, but any programs that need direct read access to the system's memory
can thus be made sgid kmem.
-
dialout: Full and direct access to serial ports. Members of this group can
reconfigure the modem, dial anywhere, etc.
-
dip: THe group's man stands for "Dialup IP". Being in group dip
allows you to use a tool such as ppp, dip,
wvdial, etc. to dial up a connection. The users in this group
cannot configure the modem, they can just run the programs that make use of it.
-
fax: Allows members to use fax software to send / receive faxes.
-
voice: Voicemail, useful for systems that use modems as answering machines.
-
cdrom: This group can be used locally to give a set of users access to a cdrom
drive.
-
floppy: This group can be used locally to give a set of users access to a
floppy drive.
-
tape: This group can be used locally to give a set of users access to a tape
drive.
-
sudo: Members of this group do not need to type their password when using sudo.
See /usr/share/doc/sudo/OPTIONS.
-
audio: This group can be used locally to give a set of users access to an audio
device.
-
src: This group owns source code, including files in /usr/src. It
can be used locally to give a user the ability to manage system source code.
-
shadow: /etc/shadow is readable by this group. Some programs that
need to be able to access the file are set gid shadow.
-
utmp: This group can write to /var/run/utmp and similar files.
Programs that need to be able to write to it are sgid utmp.
-
video: This group can be used locally to give a set of users access to an video
device.
-
staff: Allows users to add local modifications to the system
(/usr/local, /home) without needing root privileges.
Compare with group "adm", which is more related to
monitoring/security.
-
users: While Debian systems use the user group system by default (each user has
their own group), some prefer to use a more traditional group system. In that
system, each user is a member of the 'users' group.
|
