user nobody mixed group id between nobody & nogroup .

babydr · 03-19-2023, 04:30 PM

Describing the issue ...

Code:

# grep nobody /etc/passwd /etc/shadow /etc/group
/etc/passwd:nobody:x:99:99:nobody:/:/bin/false
/etc/shadow:nobody:*:9797:0:::::
/etc/group:nobody:x:98:nobody

# grep ':9[89]:' /etc/passwd /etc/shadow /etc/group
/etc/passwd:nobody:x:99:99:nobody:/:/bin/false
/etc/group:nobody:x:98:nobody
/etc/group:nogroup:x:99:

As it should be ...
Or possibly removing the group 'nobody' or 'npgroup' .

Code:

# grep nobody /etc/passwd /etc/shadow /etc/group
/etc/passwd:nobody:x:99:98:nobody:/:/bin/false
/etc/shadow:nobody:*:9797:0:::::
/etc/group:nobody:x:98:nobody

# grep ':9[89]:' /etc/passwd /etc/shadow /etc/group
/etc/passwd:nobody:x:99:98:nobody:/:/bin/false
/etc/group:nobody:x:98:nobody
/etc/group:nogroup:x:99:

Hth , JimL

frankbell · 03-19-2023, 08:21 PM

You might find this thread from Stack Exchange germane.

Me, I would tend not to mess with the defaults, but that's just me.

GazL · 03-23-2023, 08:06 AM

Probably historical/distro differences. Some distros, especially those that use the common "user=group" model (where both user/group names and uid/gid match) will use nobody:nobody for the unprivileged user and its primary group, while those that stick to the more traditional model, like Slackware, will likely use nobody:nogroup. Slackware possibly (just a guess) added the 'nobody' group later for compatibility reasons, but the gid 99 was already taken by nogroup, so it's 98 instead.

My CRUX box just has:
$ id nobody
uid=99(nobody) gid=99(nobody) groups=99(nobody)
and there is no 'nogroup'

It's a little less tidy having the uid/gid not match on Slackware, but it doesn't really hurt anything.

jayjwa · 03-23-2023, 01:00 PM

I don't remember when the "nobody:nobody" bit started, but it wasn't always this way. I don't allow it here.

Code:

id nobody
uid=99(nobody) gid=99(nogroup) groups=99(nogroup)

Personally, I'm not a fan of dozens of unneeded users/groups in the passwd/group files as that in itself gives a greater attack surface to the system (more users to secure, more users for an attacker to attempt logins as re ssh, ftp, or webservers) but that's an argument for another time.