Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

After I read List all human users I noticed that there is a user account named 'nobody' in my Ubuntu system.

Also I noticed that I can login in this account from terminal using the following command and my password:

sudo su nobody

su nobody

It doesn't mind me at all, but I want to know what is the purpose of this user? Is it created by default on a fresh install of Ubuntu or is created by installing a particular package?

share|improve this question
5  
Note that when you log in using your password, you're using your password for the sudo step, not for the nobody account (and that the reason it works is because the superuser can su to anyone without needing to enter their password (although as mentioned below, I believe at least on RH-derivatives, if nobody's shell is set to /sbin/nologin, you still wouldn't be able to log in even using superuser (aka root) –  Foon Aug 8 '13 at 14:48

3 Answers 3

up vote 39 down vote accepted

It's there to run things that don't need any special permissions. It's usually reserved for vulnerable services (httpd, etc) so that if they get hacked, they'll have minimal damage on the rest of the system.

Contrast this with running something as a real user, if that service were compromised (web servers are occasionally exploited to run arbitrary code), it would run as that user and have access to everything that user had. In most cases, this is as bad as getting root.

You can read a little bit more about the nobody user on the Ubuntu Wiki:

To answer your follow-ups:

Why I can't access this account with su nobody?

sudo grep nobody /etc/shadow will show you that nobody doesn't have a password and you can't su without an account password. The cleanest way is to sudo su nobody instead. That'll leave you in a pretty desolate sh shell.

Can you give a particular example when is indicated to use this account?

When permissions aren't required for a program's operations. This is most notable when there isn't ever going to be any disk activity.

A real world example of this is memcached (a key-value in-memory cache/database/thing), sitting on my computer and my server running under the nobody account. Why? Because it just doesn't need any permissions and to give it an account that did have write access to files would just be a needless risk.

share|improve this answer
    
Just two more things if you can explain: 1) why I can't access this account with su nobody and 2) can you give a particular example when is indicated to use this account? –  Radu Rădeanu Aug 7 '13 at 19:34
    
@RaduRădeanu 1) I'm guessing that's because it doesn't have a password set, and when you su as an ordinary user, you must give the target user's password. Try sudo -i then su nobody from the root shell (which won't require a password). –  Michael Kjörling Aug 7 '13 at 20:40
    
Network File System maps root to nobody so local root cannot access everything like the remote root can. –  Sylwester Aug 7 '13 at 21:36
    
@RaduRădeanu I've edited to pull in and answer your questions. –  Oli Aug 7 '13 at 22:12
1  
@RaduRădeanu Please note the edit history. When I tested the original command (not what's there) this originally I was ending up in a dash (/bin/sh) shell but I can't replicate that now. Your original edit was fine. It wasn't me who changed it. –  Oli Mar 29 at 18:48

In many Unix variants, "nobody" is the conventional name of a user account which owns no files, is in no privileged groups, and has no abilities except those which every other user has.

It is common to run daemons as nobody, especially servers, in order to limit the damage that could be done by a malicious user who gained control of them. However, the usefulness of this technique is reduced if more than one daemon is run like this, because then gaining control of one daemon would provide control of them all. The reason is that nobody-owned processes have the ability to send signals to each other and even debug each other, allowing them to read or even modify each other's memory.

Information taken from http://en.wikipedia.org/wiki/Nobody_(username).

share|improve this answer

The nobody user is created by default on a fresh install (checked on Ubuntu Desktop 13.04).

In many *nix variants, nobody is the conventional name of a user account which owns no files, is in no privileged groups, and has no abilities except those which every other user has (the nobody user and group do not have any entry in the /etc/sudoers file).

It is common to run daemons as nobody, especially servers, in order to limit the damage that could be done by a malicious user who gained control of them. However, the usefulness of this technique is reduced if more than one daemon is run like this, because then gaining control of one daemon would provide control of them all. The reason is that nobody-owned processes have the ability to send signals to each other and even debug each other, allowing them to read or even modify each other's memory.

Source: Wikipedia - Nobody (username)


The nobody-owned processes are able to send signals to each others and even ptrace each other in Linux, meaning that a nobody-owned process can read and write the memory of another nobody-owned process.

This is a sample entry of the nobody user in the /etc/passwd file:

alaa@aa-lu:~$ grep nobody /etc/passwd
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh

As you may notice, the nobody user has /bin/sh as a login shell and /nonexistent as the home directory. As the name suggests, the /nonexistent directory does not exist, by default.

If you are paranoid, you can set nobody’s default shell as /usr/sbin/nologin and so, deny the ssh login for the nobody user.

Source: LinuxG.net - The Linux and Unix Nobody User

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.