diff --git a/Changelog b/Changelog
--- a/Changelog
+++ b/Changelog
@@ -1,3 +1,9 @@
+Iptadmin 1.0.1    14.07.2011:
+  * Add command line options --version, --help.
+  * Syslog logging.
+  * Daemonize properly.
+  * Check that iptadmin is run under root.
+
 Iptadmin 1.0.0    05.07.2011:
 
   * First public release.
diff --git a/doc/examples/init/iptadmin b/doc/examples/init/iptadmin
--- a/doc/examples/init/iptadmin
+++ b/doc/examples/init/iptadmin
@@ -8,16 +8,21 @@
 case "$1" in
   start)
         echo -n "Starting iptables-admin"
-        /usr/bin/iptadmin &
+        /usr/bin/iptadmin start
         echo "."
         ;;
   stop)
         echo -n "Stopping iptables-admin"
-        /usr/bin/killall iptadmin
+        /usr/bin/iptadmin stop
         echo "."
         ;;
+  restart)
+        echo -n "Restarting iptables-admin"
+        /usr/bin/iptadmin restart
+        echo "."
+        ;;
   *)
-        echo "Usage: /sbin/service iptadmin {start|stop}"
+        echo "Usage: /sbin/service iptadmin {start|stop|restart}"
         exit 1
 esac
 
diff --git a/iptadmin.cabal b/iptadmin.cabal
--- a/iptadmin.cabal
+++ b/iptadmin.cabal
@@ -1,5 +1,5 @@
 Name:           iptadmin
-Version:        1.0.0
+Version:        1.0.1
 Cabal-Version:  >= 1.4
 Author:         Evgeny Tarasov
 Build-type:     Simple
@@ -41,11 +41,13 @@
                     containers >= 0.3,
                     time >= 1.1 && < 2,
                     random >= 1.0 && < 2,
-                    pam >= 0.1,
+                    pam >= 0.1 && < 1,
                     unix >= 2.4 && < 3,
                     ConfigFile >= 1.0 && < 2,
                     filepath >= 1.1 && < 2,
-                    network >= 2.2 && < 3
+                    network >= 2.2 && < 3,
+                    hsyslog >= 1.4 && < 2,
+                    hdaemonize >= 0.4.4 && < 0.5
     Main-Is:        Main.hs
     Other-modules:  IptAdmin.AccessControl
                     IptAdmin.AddChainPage
diff --git a/src/Main.hs b/src/Main.hs
--- a/src/Main.hs
+++ b/src/Main.hs
@@ -6,8 +6,10 @@
 import Control.Monad.Error
 import Control.Monad.State
 import Data.IORef
-import Data.Map
+import Data.List hiding (insert)
+import Data.Map hiding (map)
 import Data.Monoid
+import Data.Version
 import Happstack.Server.SimpleHTTP
 import Happstack.State
 import IptAdmin.AccessControl
@@ -25,38 +27,59 @@
 import IptAdmin.Types
 import IptAdmin.Utils
 import Network.Socket
+import Paths_iptadmin (version)
 import Prelude hiding (catch)
 import System.Exit
+import System.Environment
+import System.Posix.Daemonize
+import System.Posix.User
+import System.Posix.Syslog
 
 main :: IO ()
 main = do
+    args <- getArgs
+    case args of
+        ("--version":_) -> do
+            let ver = intercalate "." $ map show $ versionBranch version
+            putStrLn $ "Iptadmin v" ++ ver ++ ", (C) Evgeny Tarasov 2011"
+            exitSuccess
+        ("--help":_) -> do
+            putStrLn $ "usage: iptadmin (start|stop|restart)"
+            exitSuccess
+        _ -> return ()
+
+    checkRunUnderRoot
+
     configE <- catch (runErrorT getConfig) $
         \ e -> return $ Left $ show (e :: SomeException)
     case configE of
         Left e -> do
             putStrLn e
             exitFailure
-        Right config -> do
-            sessions <- newIORef empty
-            let httpConf = Conf (cPort config) Nothing
+        Right config ->
+            serviced $ simpleDaemon {program = startDaemon config, user = Just "root", syslogOptions = [PID, PERROR]}
 
-            -- create socket manually because we must listen only on 127.0.0.1
-            sock <- socket AF_INET Stream defaultProtocol
-            setSocketOption sock ReuseAddr 1
-            loopbackIp <- inet_addr "127.0.0.1"
-            bindSocket sock $
-                SockAddrInet (fromInteger $ toInteger $ cPort config) loopbackIp
-            listen sock (max 1024 maxListenQueue)
+startDaemon :: IptAdminConfig -> a -> IO ()
+startDaemon config _ = do
+    sessions <- newIORef empty
+    let httpConf = Conf (cPort config) Nothing
 
-            httpTid <- forkIO $ simpleHTTPWithSocket' unpackErrorT
-                                                      sock
-                                                      httpConf
-                                                      $ authorize sessions config control
+    -- create socket manually because we must listen only on 127.0.0.1
+    sock <- socket AF_INET Stream defaultProtocol
+    setSocketOption sock ReuseAddr 1
+    loopbackIp <- inet_addr "127.0.0.1"
+    bindSocket sock $
+        SockAddrInet (fromInteger $ toInteger $ cPort config) loopbackIp
+    listen sock (max 1024 maxListenQueue)
 
-            waitForTermination
-            putStrLn "Shutting down..."
-            killThread httpTid
-            putStrLn "Shutdown complete"
+    httpTid <- forkIO $ simpleHTTPWithSocket' unpackErrorT
+                                              sock
+                                              httpConf
+                                              $ authorize sessions config control
+    waitForTermination
+    syslog Notice "Shutting down..."
+    killThread httpTid
+    syslog Notice "Shutdown complete"
 
 unpackErrorT :: (Monad m) => UnWebT (ErrorT String m) a -> UnWebT m a
 unpackErrorT handler = do
@@ -98,3 +121,10 @@
                         (m', True)
     when change saveIptables
     mzero
+
+checkRunUnderRoot :: IO ()
+checkRunUnderRoot = do
+    userID_ <- getEffectiveUserID
+    when (userID_ /= 0) $ do
+        putStrLn "the program have to be run under root privileges"
+        exitFailure