We have an open ticket, https://fedorahosted.org/freeipa/ticket/1712, requesting to add more HBAC services groups by default to IPA. We're looking for suggestions on groups of services to add. We currently provide just two groups, ftp and sudo. thanks rob