diff --git a/debian/TODO b/debian/TODO
index 45f4e49a05..2978deb3ee 100644
--- a/debian/TODO
+++ b/debian/TODO
@@ -1,4 +1,2 @@
 
- * run as non-privileged user
- * cassandra-cli requires root for access to log files (and shouldn't)
  * don't embed jars for which debian packages exist
diff --git a/debian/cassandra.postinst b/debian/cassandra.postinst
new file mode 100644
index 0000000000..1ac93852cf
--- /dev/null
+++ b/debian/cassandra.postinst
@@ -0,0 +1,55 @@
+#!/bin/sh
+# postinst script for cassandra
+
+set -e
+
+# summary of how this script can be called:
+#        * <postinst> `configure' <most-recently-configured-version>
+#        * <old-postinst> `abort-upgrade' <new version>
+#        * <conflictor's-postinst> `abort-remove' `in-favour' <package>
+#          <new-version>
+#        * <postinst> `abort-remove'
+#        * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
+#          <failed-install-package> <version> `removing'
+#          <conflicting-package> <version>
+# for details, see http://www.debian.org/doc/debian-policy/ or
+# the debian-policy package
+
+case "$1" in
+    configure)
+        if ! getent group cassandra >/dev/null; then
+            addgroup --system cassandra
+        fi
+
+        if ! getent passwd cassandra >/dev/null; then
+            adduser --quiet \
+                --system \
+                --ingroup cassandra \
+                --quiet \
+                --disabled-login \
+                --disabled-password \
+                --home /var/lib/cassandra \
+                --no-create-home \
+                -gecos "Cassandra database" \
+                cassandra
+        fi
+
+        if [ -n $2 ] && dpkg --compare-versions "$2" le 0.6.4-2; then
+            chown -R cassandra: /var/lib/cassandra
+            chown -R cassandra: /var/log/cassandra
+        fi
+    ;;
+
+    abort-upgrade|abort-remove|abort-deconfigure)
+    ;;
+
+    *)
+        echo "postinst called with unknown argument \`$1'" >&2
+        exit 1
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
diff --git a/debian/init b/debian/init
index ef1c4a5bad..31c224666a 100644
--- a/debian/init
+++ b/debian/init
@@ -85,6 +85,7 @@ do_start()
     is_running && return 1
 
     $JSVC \
+        -user cassandra \
         -home $JAVA_HOME \
         -pidfile $PIDFILE \
         -errfile "&1" \