On Wed, 09 Mar 2022 at 14:10:04 +0100, Harald Dunkel wrote: > I think it would be helpful to define "system account" and "normal user". > Neither adduser(8) nor useradd(8) provide a sufficient definition, > especially wrt the existing network directory services (LDAP, AD, etc). > Is a "system user" supposed to be a local account, defined in /etc/passwd > only?
I think the intention is: - a system account is a uid used internally by system services (some common examples: www-data, messagebus, Debian-exim, _apt) - a normal user is either an account representing a person (like the 'smcv' user on Debian infrastructure), or a "role" account shared by several people but otherwise used in the same way as an account representing a person (like the "release" user on Debian infrastructure, which is used by the release team) That definition doesn't say anything about whether a system user is defined locally or in a directory service, but there are serious practical problems with managing system users via directory services, so system users should usually (always?) be defined locally. Normal users can either be local or in a directory service. In particular, if an early-boot service (like systemd or udev) or a service that might be required before networking comes up (like dbus-daemon) needs to know about a system user, then the system user must be defined locally, to avoid sequencing problems during boot. > Related question: How are naming collisions between local entries and > the entries in a network directory service supposed to be handled? Debian Policy now encourages new system accounts to be created with an underscore prefix (like _apt and _flatpak), so that they will not collide with human users' login names. This convention was borrowed from one of the BSDs, as a pragmatic way to reserve a namespace while keeping account names short. System accounts that existed before that Policy change have a bewildering variety of naming conventions, and renaming a pre-existing account is not straightforward, so older system account naming conventions like Debian-exim, systemd-coredump, debian-tor and messagebus (dbus-daemon) will unfortunately continue to exist for a long time. smcv