Linux Labs

Users, permissions, and processes / Stage 6 of 13

Accounts and their lifecycle

Not running Starting usually ~20 s
Leave the lesson

Step 4 of 7 · on a machine · 6 min

Service accounts and nologin

A web server or a database needs its own account, and no person needs to log in as it. The www-data account shows how this works.

You have already run commands as www-data, the web server's account. Look at its line and try to log in as it: sudo -i -u name starts a login as that user: the -i option tells sudo to run the user's login shell, as when logging in at the keyboard.

Exercise · look

Log in as www-data

Look at the www-data account's line, try to log in as it, and run id as it.

First, predict

What will sudo -i -u www-data do?

Now start the exercise, run the command and compare your prediction with the output.

Sign in and start The machine is available after signing in

The last field of the www-data line is /usr/sbin/nologin. nologin is a program that prints This account is currently not available. and exits. A login starts it instead of a shell, and that is the end of it. sudo -u www-data id does not start the login shell, so it works: that is how the system runs services as their accounts.

Accounts for services are created with -r and nologin from the start: sudo useradd -r -s /usr/sbin/nologin name. Such an account gets no home directory.

Ubuntu 24.04
Loading…