setup/teardown user/groups needed for Wireshark

fixes #2941