diff --git a/NEWS b/NEWS
index 5b33983e9..00d36eda1 100644
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,10 @@ New features
  - sogo-tool: new "dump-defaults" command to easily create /etc/sogo.conf
 
 Enhancements
+ - The sogo user is now a system user.
+   For new installs, this means that 'su - sogo' won't work anymore.
+   Please use 'sudo -u sogo cmd' instead
+   If used in scripts from cronjobs, 'requiretty' must be disabled in sudoers
  - added basic support for LDAP URL in user sources
  - renamed default SOGoForceIMAPLoginWithEmail to
    SOGoForceExternalLoginWithEmail and extended it to SMTP authentication
diff --git a/Tests/Integration/test-sogo-tool.py b/Tests/Integration/test-sogo-tool.py
index 1da98ca54..1e4e604c1 100755
--- a/Tests/Integration/test-sogo-tool.py
+++ b/Tests/Integration/test-sogo-tool.py
@@ -32,7 +32,7 @@ class sogoToolTest(unittest.TestCase):
       self.assertEqual(os.getuid(), 0, "this test must run as root...")
 
       os.chown(self.backupdir, uid, gid)
-      status = os.system("su - %s -c \"(cd %s && %s backup . ALL >/dev/null 2>&1)\""
+      status = os.system("sudo -u %s bash -c \"(cd %s && %s backup . ALL >/dev/null 2>&1)\""
                           % (sogo_user, self.backupdir, sogo_tool_path))
 
       rc=os.WEXITSTATUS(status)
diff --git a/packaging/debian-multiarch/sogo.init b/packaging/debian-multiarch/sogo.init
index 9dc4b5c27..cf0600cdd 100644
--- a/packaging/debian-multiarch/sogo.init
+++ b/packaging/debian-multiarch/sogo.init
@@ -62,10 +62,10 @@ case "$1" in
   start)
 	log_daemon_msg "Starting $DESC" "$NAME"
 
-        # Ensure directory's existence and permissions
-        install -o $USER -g adm -m 755 -d /var/run/$NAME
-        install -o $USER -g adm -m 750 -d /var/spool/$NAME
-        install -o $USER -g adm -m 750 -d /var/log/$NAME
+        # Enforce directory existence and permissions
+        install -o $USER -g $USER -m 755 -d /var/run/$NAME
+        install -o $USER -g $USER -m 750 -d /var/spool/$NAME
+        install -o $USER -g $USER -m 750 -d /var/log/$NAME
 
 	if ! start-stop-daemon -c $USER --quiet --start --pidfile $PIDFILE --exec $DAEMON -- $DAEMON_OPTS 
 	then
diff --git a/packaging/debian-multiarch/sogo.postinst b/packaging/debian-multiarch/sogo.postinst
index e43bfd92a..c4a7272fd 100644
--- a/packaging/debian-multiarch/sogo.postinst
+++ b/packaging/debian-multiarch/sogo.postinst
@@ -18,8 +18,8 @@ PATH=/bin:/sbin:/usr/bin:/usr/sbin
 
 case "$1" in
     configure)
-	  # update timestamp on imgs,css,js to let apache know the files changed
-	  find /usr/lib/GNUstep/SOGo/WebServerResources  -exec touch {} \;
+          # update timestamp on imgs,css,js to let apache know the files changed
+          find /usr/lib/GNUstep/SOGo/WebServerResources  -exec touch {} \;
         ;;
 
     abort-upgrade|abort-remove|abort-deconfigure)
diff --git a/packaging/debian-multiarch/sogo.preinst b/packaging/debian-multiarch/sogo.preinst
index 384bffc2a..fc2d475bf 100644
--- a/packaging/debian-multiarch/sogo.preinst
+++ b/packaging/debian-multiarch/sogo.preinst
@@ -11,19 +11,16 @@ set -e
 # for details, see http://www.debian.org/doc/debian-policy/ or
 # the debian-policy package
 
-if test "x$1" == "xinstall" && test -z "$2"
-then
+if [ "$1" == "install" ] || [ "$1" == "upgrade" ]; then
+
   if ! id sogo 1> /dev/null 2>&1; then
-    groupadd -f -K GID_MIN=100 -K GID_MAX=500 sogo
-    useradd -d /home/sogo -g sogo -m -K UID_MIN=100 -K UID_MAX=500 -K PASS_MAX_DAYS=-1 -s /bin/bash sogo
+    groupadd -f -r sogo
+    useradd -d /var/lib/sogo -g sogo -c "SOGo daemon" -s /usr/sbin/nologin -M -r sogo
   fi
 
-  for dir in run spool log
-  do
-    if ! test -d /var/$dir/sogo
-    then
-      install -m 750 -o sogo -g sogo -d /var/$dir/sogo
-    fi
+  # create mandatory dirs and enforce owner/perms
+  for dir in lib log run spool; do
+    install -m 750 -o sogo -g sogo -d /var/$dir/sogo
   done
 fi
 
diff --git a/packaging/debian/sogo.init b/packaging/debian/sogo.init
index 9dc4b5c27..cf0600cdd 100644
--- a/packaging/debian/sogo.init
+++ b/packaging/debian/sogo.init
@@ -62,10 +62,10 @@ case "$1" in
   start)
 	log_daemon_msg "Starting $DESC" "$NAME"
 
-        # Ensure directory's existence and permissions
-        install -o $USER -g adm -m 755 -d /var/run/$NAME
-        install -o $USER -g adm -m 750 -d /var/spool/$NAME
-        install -o $USER -g adm -m 750 -d /var/log/$NAME
+        # Enforce directory existence and permissions
+        install -o $USER -g $USER -m 755 -d /var/run/$NAME
+        install -o $USER -g $USER -m 750 -d /var/spool/$NAME
+        install -o $USER -g $USER -m 750 -d /var/log/$NAME
 
 	if ! start-stop-daemon -c $USER --quiet --start --pidfile $PIDFILE --exec $DAEMON -- $DAEMON_OPTS 
 	then
diff --git a/packaging/debian/sogo.postinst b/packaging/debian/sogo.postinst
index e43bfd92a..c4a7272fd 100644
--- a/packaging/debian/sogo.postinst
+++ b/packaging/debian/sogo.postinst
@@ -18,8 +18,8 @@ PATH=/bin:/sbin:/usr/bin:/usr/sbin
 
 case "$1" in
     configure)
-	  # update timestamp on imgs,css,js to let apache know the files changed
-	  find /usr/lib/GNUstep/SOGo/WebServerResources  -exec touch {} \;
+          # update timestamp on imgs,css,js to let apache know the files changed
+          find /usr/lib/GNUstep/SOGo/WebServerResources  -exec touch {} \;
         ;;
 
     abort-upgrade|abort-remove|abort-deconfigure)
diff --git a/packaging/debian/sogo.preinst b/packaging/debian/sogo.preinst
index 384bffc2a..fc2d475bf 100644
--- a/packaging/debian/sogo.preinst
+++ b/packaging/debian/sogo.preinst
@@ -11,19 +11,16 @@ set -e
 # for details, see http://www.debian.org/doc/debian-policy/ or
 # the debian-policy package
 
-if test "x$1" == "xinstall" && test -z "$2"
-then
+if [ "$1" == "install" ] || [ "$1" == "upgrade" ]; then
+
   if ! id sogo 1> /dev/null 2>&1; then
-    groupadd -f -K GID_MIN=100 -K GID_MAX=500 sogo
-    useradd -d /home/sogo -g sogo -m -K UID_MIN=100 -K UID_MAX=500 -K PASS_MAX_DAYS=-1 -s /bin/bash sogo
+    groupadd -f -r sogo
+    useradd -d /var/lib/sogo -g sogo -c "SOGo daemon" -s /usr/sbin/nologin -M -r sogo
   fi
 
-  for dir in run spool log
-  do
-    if ! test -d /var/$dir/sogo
-    then
-      install -m 750 -o sogo -g sogo -d /var/$dir/sogo
-    fi
+  # create mandatory dirs and enforce owner/perms
+  for dir in lib log run spool; do
+    install -m 750 -o sogo -g sogo -d /var/$dir/sogo
   done
 fi
 
diff --git a/packaging/rhel/sogo.spec b/packaging/rhel/sogo.spec
index 27a986443..f283fd153 100644
--- a/packaging/rhel/sogo.spec
+++ b/packaging/rhel/sogo.spec
@@ -195,8 +195,9 @@ mkdir -p ${RPM_BUILD_ROOT}/etc/logrotate.d
 mkdir -p ${RPM_BUILD_ROOT}/etc/sysconfig
 mkdir -p ${RPM_BUILD_ROOT}/etc/httpd/conf.d
 mkdir -p ${RPM_BUILD_ROOT}/usr/sbin
-mkdir -p ${RPM_BUILD_ROOT}/var/run/sogo
+mkdir -p ${RPM_BUILD_ROOT}/var/lib/sogo
 mkdir -p ${RPM_BUILD_ROOT}/var/log/sogo
+mkdir -p ${RPM_BUILD_ROOT}/var/run/sogo
 mkdir -p ${RPM_BUILD_ROOT}/var/spool/sogo
 cat Apache/SOGo.conf | sed -e "s@/lib/@/%{_lib}/@g" > ${RPM_BUILD_ROOT}/etc/httpd/conf.d/SOGo.conf
 install -m 600 Scripts/sogo.cron ${RPM_BUILD_ROOT}/etc/cron.d/sogo
@@ -228,9 +229,10 @@ rm -fr ${RPM_BUILD_ROOT}
 
 /etc/init.d/sogod
 /etc/cron.daily/sogo-tmpwatch
-/var/run/sogo
-/var/log/sogo
-/var/spool/sogo
+%dir %attr(0700, sogo, sogo) %{_var}/lib/sogo
+%dir %attr(0700, sogo, sogo) %{_var}/log/sogo
+%dir %attr(0755, sogo, sogo) %{_var}/run/sogo
+%dir %attr(0700, sogo, sogo) %{_var}/spool/sogo
 %{_sbindir}/sogod
 %{_libdir}/libSOGo.so.*
 %{_libdir}/libSOGoUI.so.*
@@ -299,12 +301,12 @@ rm -fr ${RPM_BUILD_ROOT}
 %endif
 
 # **************************** pkgscripts *****************************
+%pre
+if ! id sogo >& /dev/null; then
+  /usr/sbin/useradd -d %{_var}/lib/sogo -c "SOGo daemon" -s /sbin/nologin -M -r sogo
+fi
+
 %post
-if ! id sogo >& /dev/null; then /usr/sbin/useradd -m -k /var/empty -r sogo > /dev/null 2>&1; fi
-/bin/chown sogo /var/run/sogo
-/bin/chown sogo /var/log/sogo
-/bin/chown sogo /var/spool/sogo
-/bin/chmod 700 /var/spool/sogo
 # update timestamp on imgs,css,js to let apache know the files changed
 find %{_libdir}/GNUstep/SOGo/WebServerResources  -exec touch {} \;
 /sbin/chkconfig --add sogod
@@ -322,12 +324,17 @@ if test "$1" = "0"
 then
   /usr/sbin/userdel sogo
   /usr/sbin/groupdel sogo > /dev/null 2>&1
-  /bin/rm -rf /var/run/sogo
-  /bin/rm -rf /var/spool/sogo
+  /bin/rm -rf %{_var}/run/sogo
+  /bin/rm -rf %{_var}/spool/sogo
+  # not removing /var/lib/sogo to keep .GNUstepDefaults
 fi
 
 # ********************************* changelog *************************
 %changelog
+* Tue Jan 22 2013 Jean Raby <jraby@inverse.ca>
+- Create the sogo user as a system user
+- Use %attr() to set directory permissions instead of chown/chmod
+
 * Mon Nov 12 2012 Jean Raby <jraby@inverse.ca>
 - Add missing dependency on lasso and lasso-devel