The user nobody is reserved for NFS only.
The anwers above are rather wrong, because they assume that nobody
is a "generic" anonymous/guest style user id.
In the UNIX/Linux access control model anonymous/guest style user ids don't exist and these are bad suggestions:
- "common to run daemons as
nobody
, especially servers, in order to limit the damage that could be done by a malicious user who gained control of them." because of the that follows: "However, the usefulness of this technique is reduced if more than one daemon is run like this, because then gaining control of one daemon would provide control of them all".
- "A real world example of this is
memcached
(a key-value in-memory cache/database/thing), sitting on my computer and my server running under the nobody
account. Why? Because it just doesn't need any permissions and to give it an account that did have write access to files would just be a needless risk."
The nobody
user name with user id 65534 was created and reserved for a specific purpose and should be used only for that purpose: as a placeholder for "unmapped" users and user ids in NFS tree exports.
That is, unless user/id mapping is setup for NFS tree exports, all files in the export will appear owned by nobody
. The purpose of this is to prevent all users on the importing system from accessing those files (unless they have "other" permissions), as none of them (except root
) can be/become nobody
.
Therefore it is a very bad idea to use nobody
for any other purpose, because its purpose is to be a user name/user id for files that must not be accessible to anybody.
The Wiki entry is very wrong too.
The UNIX/Linux practice is to create a new account for each "application" or application area that needs a separate access control domain, and to never reuse nobody
outside NFS.
sudo su nobody
return This account is currently not available. because the shell for the usernobody
is set to/usr/sbin/nologin
(getent passwd nobody
).root_squash
on it will map root to nobody on remote systems. This is more or less exactly the opposite of what this answer states