diff --git a/debian/changelog b/debian/changelog
index ebf1e9c9..cb9f338e 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -39,6 +39,7 @@ shadow (1:4.2-1) UNRELEASED; urgency=low
   * Allow LXC devices (lxc/console, lxc/tty[1234]) in securetty.linux
   * Update documentation of UMASK: Explain that USERGROUPS_ENAB will modify
     this default for UPGs. (Closes: #583971)
+  * login.postinst: install a default /etc/subuid and /etc/subgid
 
  -- Christian Perrier <bubulle@debian.org>  Sat, 27 Jul 2013 20:07:18 +0200
 
diff --git a/debian/login.postinst b/debian/login.postinst
index 59d6b7fc..39aa57c0 100644
--- a/debian/login.postinst
+++ b/debian/login.postinst
@@ -24,6 +24,19 @@ then
 	fi
 fi
 
+        # Create subuid/subgid if missing
+        if [ ! -e /etc/subuid ]; then
+                touch /etc/subuid
+                chown root:root /etc/subuid
+                chmod 644 /etc/subuid
+        fi
+
+        if [ ! -e /etc/subgid ]; then
+                touch /etc/subgid
+                chown root:root /etc/subgid
+                chmod 644 /etc/subgid
+        fi
+
 #DEBHELPER#
 
 exit 0