Can someone please explain why nearly all of these items end with "false"?

[Brawdy14]

##
# User Database
#
# Note that this file is consulted directly only when the system is running
# in single-user mode. At other times this information is provided by
# Open Directory.
#
# See the opendirectoryd(8) man page for additional information about
# Open Directory.
##
nobody:*:-2:-2::0:0:Unprivileged User:/var/empty:/usr/bin/false
root:*:0:0::0:0:System Administrator:/var/root:/bin/sh
daemon:*:1:1::0:0:System Services:/var/root:/usr/bin/false
_uucp:*:4:4::0:0:Unix to Unix Copy Protocol:/var/spool/uucp:/usr/sbin/uucico
_taskgated:*:13:13::0:0:Task Gate Daemon:/var/empty:/usr/bin/false
_networkd:*:24:24::0:0:Network Services:/var/networkd:/usr/bin/false
_installassistant:*:25:25::0:0:Install Assistant:/var/empty:/usr/bin/false
_lp:*:26:26::0:0rinting Services:/var/spool/cups:/usr/bin/false
_postfix:*:27:27::0:0ostfix Mail Server:/var/spool/postfix:/usr/bin/false
_scsd:*:31:31::0:0:Service Configuration Service:/var/empty:/usr/bin/false
_ces:*:32:32::0:0:Certificate Enrollment Service:/var/empty:/usr/bin/false
_appstore:*:33:33::0:0:Mac App Store Service:/var/db/appstore:/usr/bin/false
_mcxalr:*:54:54::0:0:MCX AppLaunch:/var/empty:/usr/bin/false
_appleevents:*:55:55::0:0:AppleEvents Daemon:/var/empty:/usr/bin/false
_geod:*:56:56::0:0:Geo Services Daemon:/var/db/geod:/usr/bin/false
_devdocs:*:59:59::0:0eveloper Documentation:/var/empty:/usr/bin/false
_sandbox:*:60:60::0:0:Seatbelt:/var/empty:/usr/bin/false
_mdnsresponder:*:65:65::0:0:mDNSResponder:/var/empty:/usr/bin/false
_ard:*:67:67::0:0:Apple Remote Desktop:/var/empty:/usr/bin/false
_www:*:70:70::0:0:World Wide Web Server:/Library/WebServer:/usr/bin/false
_eppc:*:71:71::0:0:Apple Events User:/var/empty:/usr/bin/false
_cvs:*:72:72::0:0:CVS Server:/var/empty:/usr/bin/false
_svn:*:73:73::0:0:SVN Server:/var/empty:/usr/bin/false
_mysql:*:74:74::0:0:MySQL Server:/var/empty:/usr/bin/false
_sshd:*:75:75::0:0:sshd Privilege separation:/var/empty:/usr/bin/false
_qtss:*:76:76::0:0:QuickTime Streaming Server:/var/empty:/usr/bin/false
_cyrus:*:77:6::0:0:Cyrus Administrator:/var/imap:/usr/bin/false
_mailman:*:78:78::0:0:Mailman List Server:/var/empty:/usr/bin/false
_appserver:*:79:79::0:0:Application Server:/var/empty:/usr/bin/false
_clamav:*:82:82::0:0:ClamAV Daemon:/var/virusmails:/usr/bin/false
_amavisd:*:83:83::0:0:AMaViS Daemon:/var/virusmails:/usr/bin/false
_jabber:*:84:84::0:0:Jabber XMPP Server:/var/empty:/usr/bin/false
_appowner:*:87:87::0:0:Application Owner:/var/empty:/usr/bin/false
_windowserver:*:88:88::0:0:WindowServer:/var/empty:/usr/bin/false
_spotlight:*:89:89::0:0:Spotlight:/var/empty:/usr/bin/false
_tokend:*:91:91::0:0:Token Daemon:/var/empty:/usr/bin/false
_securityagent:*:92:92::0:0:SecurityAgent:/var/db/securityagent:/usr/bin/false
_calendar:*:93:93::0:0:Calendar:/var/empty:/usr/bin/false
_teamsserver:*:94:94::0:0:TeamsServer:/var/teamsserver:/usr/bin/false
_update_sharing:*:95:-2::0:0:Update Sharing:/var/empty:/usr/bin/false
_installer:*:96:-2::0:0:Installer:/var/empty:/usr/bin/false
_atsserver:*:97:97::0:0:ATS Server:/var/empty:/usr/bin/false
_ftp:*:98:-2::0:0:FTP Daemon:/var/empty:/usr/bin/false
_unknown:*:99:99::0:0:Unknown User:/var/empty:/usr/bin/false
_softwareupdate:*:200:200::0:0:Software Update Service:/var/db/softwareupdate:/usr/bin/false
_coreaudiod:*:202:202::0:0:Core Audio Daemon:/var/empty:/usr/bin/false
_screensaver:*:203:203::0:0:Screensaver:/var/empty:/usr/bin/false
_locationd:*:205:205::0:0:Location Daemon:/var/db/locationd:/usr/bin/false
_trustevaluationagent:*:208:208::0:0:Trust Evaluation Agent:/var/empty:/usr/bin/false
_timezone:*:210:210::0:0:AutoTimeZoneDaemon:/var/empty:/usr/bin/false
_lda:*:211:211::0:0:Local Delivery Agent:/var/empty:/usr/bin/false
_cvmsroot:*:212:212::0:0:CVMS Root:/var/empty:/usr/bin/false
_usbmuxd:*:213:213::0:0:iPhone OS Device Helper:/var/db/lockdown:/usr/bin/false
_dovecot:*:214:6::0:0ovecot Administrator:/var/empty:/usr/bin/false
_dpaudio:*:215:215::0:0P Audio:/var/empty:/usr/bin/false
_postgres:*:216:216::0:0ostgreSQL Server:/var/empty:/usr/bin/false
_krbtgt:*:217:-2::0:0:Kerberos Ticket Granting Ticket:/var/empty:/usr/bin/false
_kadmin_admin:*:218:-2::0:0:Kerberos Admin Service:/var/empty:/usr/bin/false
_kadmin_changepw:*:219:-2::0:0:Kerberos Change Password Service:/var/empty:/usr/bin/false
_devicemgr:*:220:220::0:0evice Management Server:/var/empty:/usr/bin/false
_webauthserver:*:221:221::0:0:Web Auth Server:/var/empty:/usr/bin/false
_netbios:*:222:222::0:0:NetBIOS:/var/empty:/usr/bin/false
_warmd:*:224:224::0:0:Warm Daemon:/var/empty:/usr/bin/false
_dovenull:*:227:227::0:0ovecot Authentication:/var/empty:/usr/bin/false
_netstatistics:*:228:228::0:0:Network Statistics Daemon:/var/empty:/usr/bin/false
_avbdeviced:*:229:-2::0:0:Ethernet AVB Device Daemon:/var/empty:/usr/bin/false
_krb_krbtgt:*:230:-2::0:0:Open Directory Kerberos Ticket Granting Ticket:/var/empty:/usr/bin/false
_krb_kadmin:*:231:-2::0:0:Open Directory Kerberos Admin Service:/var/empty:/usr/bin/false
_krb_changepw:*:232:-2::0:0:Open Directory Kerberos Change Password Service:/var/empty:/usr/bin/false
_krb_kerberos:*:233:-2::0:0:Open Directory Kerberos:/var/empty:/usr/bin/false
_krb_anonymous:*:234:-2::0:0:Open Directory Kerberos Anonymous:/var/empty:/usr/bin/false
_assetcache:*:235:235::0:0:Asset Cache Service:/var/empty:/usr/bin/false
_coremediaiod:*:236:236::0:0:Core Media IO Daemon:/var/empty:/usr/bin/false
_launchservicesd:*:239:239::0:0:_launchservicesd:/var/empty:/usr/bin/false
_iconservices:*:240:240::0:0:IconServices:/var/empty:/usr/bin/false
_distnote:*:241:241::0:0istNote:/var/empty:/usr/bin/false
_nsurlsessiond:*:242:242::0:0:NSURLSession Daemon:/var/db/nsurlsessiond:/usr/bin/false
_displaypolicyd:*:244:244::0:0isplay Policy Daemon:/var/empty:/usr/bin/false
_astris:*:245:245::0:0:Astris Services:/var/db/astris:/usr/bin/false
_krbfast:*:246:-2::0:0:Kerberos FAST Account:/var/empty:/usr/bin/false
_gamecontrollerd:*:247:247::0:0:Game Controller Daemon:/var/empty:/usr/bin/false
_mbsetupuser:*:248:248::0:0:Setup User:/var/setup:/bin/bash
_ondemand:*:249:249::0:0:On Demand Resource Daemon:/var/db/ondemand:/usr/bin/false
_xserverdocs:*:251:251::0:0:macOS Server Documents Service:/var/empty:/usr/bin/false
_wwwproxy:*:252:252::0:0:WWW Proxy:/var/empty:/usr/bin/false
_mobileasset:*:253:253::0:0:MobileAsset User:/var/ma:/usr/bin/false
_findmydevice:*:254:254::0:0:Find My Device Daemon:/var/db/findmydevice:/usr/bin/false
_datadetectors:*:257:257::0:0ataDetectors:/var/db/datadetectors:/usr/bin/false
_captiveagent:*:258:258::0:0:captiveagent:/var/empty:/usr/bin/false
_ctkd:*:259:259::0:0:ctkd Account:/var/empty:/usr/bin/false
_applepay:*:260:260::0:0:applepay Account:/var/db/applepay:/usr/bin/false
_hidd:*:261:261::0:0:HID Service User:/var/db/hidd:/usr/bin/false
_cmiodalassistants:*:262:262::0:0:CoreMedia IO Assistants User:/var/db/cmiodalassistants:/usr/bin/false
_analyticsd:*:263:263::0:0:Analytics Daemon:/var/db/analyticsd:/usr/bin/false
_fpsd:*:265:265::0:0:FPS Daemon:/var/db/fpsd:/usr/bin/false
_timed:*:266:266::0:0:Time Sync Daemon:/var/db/timed:/usr/bin/false
_nearbyd:*:268:268::0:0roximity and Ranging Daemon:/var/db/nearbyd:/usr/bin/false
_reportmemoryexception:*:269:269::0:0:ReportMemoryException:/var/db/reportmemoryexception:/usr/bin/false
_driverkit:*:270:270::0:0riverKit:/var/empty:/usr/bin/false
_diskimagesiod:*:271:271::0:0iskImages IO Daemon:/var/db/diskimagesiod:/usr/bin/false
_logd:*:272:272::0:0:Log Daemon:/var/db/diagnostics:/usr/bin/false
_appinstalld:*:273:273::0:0:App Install Daemon:/var/db/appinstalld:/usr/bin/false
_installcoordinationd:*:274:274::0:0:Install Coordination Daemon:/var/db/installcoordinationd:/usr/bin/false
_demod:*:275:275::0:0emo Daemon:/var/empty:/usr/bin/false
_rmd:*:277:277::0:0:Remote Management Daemon:/var/db/rmd:/usr/bin/false
_accessoryupdater:*:278:278::0:0:Accessory Update Daemon:/var/db/accessoryupdater:/usr/bin/false
_knowledgegraphd:*:279:279::0:0:Knowledge Graph Daemon:/var/db/knowledgegraphd:/usr/bin/false
_coreml:*:280:280::0:0:CoreML Services:/var/empty:/usr/bin/false
_sntpd:*:281:281::0:0:SNTP Server Daemon:/var/empty:/usr/bin/false
_trustd:*:282:282::0:0:trustd:/var/empty:/usr/bin/false
_darwindaemon:*:284:284::0:0arwin Daemon:/var/db/darwindaemon:/usr/bin/false
_notification_proxy:*:285:285::0:0:Notification Proxy:/var/empty:/usr/bin/false
_oahd:*:441:441::0:0:OAH Daemon:/var/empty:/usr/bin/false

 

[auxbuss]

That’s `/etc/passwd`

Those lines don’t end with false, but with `/usr/bin/false`

You can read about the file’s format via `man 5 passwd`

The final entry on each line is the user’s login shell. `/usr/bin/false` indicates that there is no shell associated with that user (the default is `/usr/sh`)

More here: https://superuser.com/questions/118...ers-have-usr-bin-false-as-their-shell/1183321

 

[Brawdy14]

Thank you, 'auxbuss'.

Sadly, I am still no wiser. ?

 

[0128672]

Thank you, 'auxbuss'.

Sadly, I am still no wiser. 🤔

That's actually a pretty good explanation and helpful link from @auxbuss. Maybe if we understood what your specific concern is about this user database file, members could respond in a way that's more helpful to you. It's a little hard to tell if user account shells are something you're already familiar with.

 

[Brawdy14]

That's actually a pretty good explanation and helpful link from @auxbuss. Maybe if we understood what your specific concern is about this user database file, members could respond in a way that's more helpful to you. It's a little hard to tell if user account shells are something you're already familiar with.

I've been wondering if what I found has any connection to the subject of this article:-

Attackers Hijack Craigslist Emails to Bypass Security, Deliver Malware

Manipulated Craigslist emails that abuse Microsoft OneDrive warn users that their ads contain "inappropriate content.”

threatpost.com

EDIT!

Forgive me, please. I was probably mistaken about that.

Does this screenshot help you?

https://ibb.co/L1pgcRj

IIRC I found reference to it in my 'Bin' ...... so went looking for it, as I had not put it in my Bin!

I have, for quite some time, felt that there was a gremlin lurking within this machine. Hopefully, its gone now!
(new operating system installed).

 

[Brawdy14]

It's a little hard to tell if user account shells are something you're already familiar with.

I should have mentioned that I know NOTHING about "user account shells"! ?

 

[Brawdy14]

THIS MAY BE THE ANSWER!


level 1
Currawong

· 2y

In case anyone is searching for this in the future and doesn't know the answer, here's what is going on.
https://www.macrumors.com/guide/relocated-items/
As for the master.passwd.system_default file, that requires a bit of explanation. In very old-school computer systems of which MacOS is a type, the list of users that could log, as well as system user accounts (for services such as web and email) in was contained in a file called "master.passwd". It lists users, their user id number, their login shell (what you see when you open the Terminal) and their home directory/folder. Way back, it also used to contain the user's password!
As MacOS uses Open Directory for storing user information, which is far more secure (and allows network logins), the master.passwd file exists only for a legacy mode known as "single user mode". This only allows a single user to log in, via a command line (i.e.: The terminal). I haven't checked if Mojave or Catalina still have this mode (I presume they do if the files are still there) but if you can, you'd boot up the machine and get what looks like a full-screen terminal. No regular user interface (i.e.: Finder etc.) are available in that mode. It can be used for trouble-shooting, such as where there are serious issues preventing a normal log-in.
The master.passwd.system_default file is, as its name suggests, the default version of this file. Since the file might be changed by software, which might add a specific user just for running one program, a default was kept in older versions of MacOS so that the original file could be easily restored if the active one ends up broken. I guess that since it is not part of Catalina that it, and any other files from older versions of MacOS, are now removed.


Ref:

https://www.reddit.com/r/MacOS/comments/dlmnak