debian: make serf runs under its own user/group