I am converting from centOS and am used to having a nobody:nobody user:group for running services. Does Ubuntu have a similar best practice user:group combination for running a service?


You can use nobody:nogroup if you really do want a user/group with no permissions. But Debian derivatives tend to define a user and/or group per task to ensure that your unprivileged services are separated from each other.


Ubuntu has a nobody user and a nogroup group, I guess these can be used equivalently if you want.

Having all (or most) services running under the same user defeats part of the purpose of using a non-privileged user; thus I think the recommended best practice is for each service to have its own user (e.g. apache runs as www-data, I think exim4 will have an exim4 user, spamassassin will have a spamd user (I think!), and so on). When you install a service it takes care of creating this user for you. Sometimes managing permissions to ensure services can talk to each other can be slightly cumbersome, but these instances are usually well-documented and the added security and compartmentalization are worth the (minor) hassle.


It should be nobody:nogroup, even if some servers still recognize correctly the standard unix "nobody:nobody".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.