It's there to run things that don't need any special permissions. It's usually reserved for vulnerable services (httpd, etc) so that if they get hacked, they'll have minimal damage on the rest of the system.
Contrast this with running something as a real user, if that service were compromised (web servers are occasionally exploited to run arbitrary code), it would run as that user and have access to everything that user had. In most cases, this is as bad as getting root.
You can read a little bit more about the nobody user on the Ubuntu Wiki:
To answer your follow-ups:
Why I can't access this account with su nobody
?
sudo grep nobody /etc/shadow
will show you that nobody doesn't have a password and you can't su
without an account password. The cleanest way is to sudo su nobody
instead. That'll leave you in a pretty desolate sh
shell.
Can you give a particular example when is indicated to use this account?
When permissions aren't required for a program's operations. This is most notable when there isn't ever going to be any disk activity.
A real world example of this is memcached
(a key-value in-memory cache/database/thing), sitting on my computer and my server running under the nobody account. Why? Because it just doesn't need any permissions and to give it an account that did have write access to files would just be a needless risk.
sudo su nobody
return This account is currently not available. because the shell for the usernobody
is set to/usr/sbin/nologin
(getent passwd nobody
).root_squash
on it will map root to nobody on remote systems. This is more or less exactly the opposite of what this answer statesgrep
,sed
...). I don't want this feature to be a too large security risk (e.g. specifyrm *
as "text processing" command)... Runninggrep
orsed
as user "nobody" eliminates this risk.