[SOLVED] What is the user 1000?

massy · 07-05-2014, 05:46 AM

I've understood that the owner of some files is 1000(user), what is
it? and why there is it!?

Code:

uname -a
Linux RSU-2-15 2.6.32.10 #13 SMP PREEMPT Wed May 22 16:09:03 UTC 2013 i586 GNU/Linux

Code:

ls -l /var/
drwxr-xr-x  2 1000 root  4096 Jul  5 15:05 agentx
drwxr-xr-x  2 1000 root  4096 May 21  2012 backups
drwxr-xr-x  7 1000 root  4096 Aug  3  2012 cache
drwxr-xr-x 24 1000 root  4096 Aug 21  2013 lib
drwxrwsr-x  2 1000 staff 4096 May 21  2012 local
lrwxrwxrwx  1 root root     9 Jun 24 14:42 lock -> /run/lock
drwxrwxrwx  9 1000 sudo  4096 Jul  5 15:05 log
...

saivinoba · 07-05-2014, 06:13 AM

Usually, the user id for users created on Linux systems now starts from 1000. On Fedora/CentOS systems it used to be from 500. It is specified in /etc/login.defs file. So, a user with uid 1000 is the first normal user (non-root user) created on the system. Or if your system starts giving uid from 500, then another non-root (non administrator) user with uid 1000.

The file ownership shown in your post for directory /var (which is a system directory) is clearly a case of mess up. This directory should be owned by root only and not normal user. It's either an innocent experimentation with file permissions or an attack perhaps?

P.S.: If only uid is shown and not the name of the user, it is mostly because, the username changed.

Doc CPU · 07-05-2014, 06:14 AM

Hi there,

Quote:

Originally Posted by massy

I've understood that the owner of some files is 1000(user), what is it? and why there is it!?

typically, Linux starts creating "normal" users at UID 1000. So a user with UID 1000 is probably the first user ever created on that particular system (beside root, who always has UID 0).

[X] Doc CPU

273 · 07-05-2014, 06:19 AM

If you want to see the name of the user then you could try the following:

Code:

cat /etc/passwd|grep 1000

Doc CPU · 07-05-2014, 07:00 AM

Hi there,

Quote:

Originally Posted by saivinoba

P.S.: If only uid is shown and not the name of the user, it is mostly because, the username changed.

are you sure? If you change the user name, the new name will be displayed instead of the old one.

I'd rather assume this occurs when a user is deleted. In that case, there are still files that have UID 1000 for the file owner in their meta data, but since there is no such user any more, Linux can't display a name for it.

[X] Doc CPU

saivinoba · 07-05-2014, 08:59 AM

Quote:

Originally Posted by Doc CPU

are you sure? If you change the user name, the new name will be displayed instead of the old one.

I'd rather assume this occurs when a user is deleted. In that case, there are still files that have UID 1000 for the file owner in their meta data, but since there is no such user any more, Linux can't display a name for it.
[X] Doc CPU

You are correct. I stand corrected

uid is displayed instead of username when the user is deleted (say using 'userdel') without deleting all related files.