>_cat freeipa.md|Mail & Directory

FreeIPA Cheatsheet

SPEC: MDX·/freeipa·Mail transfer agents, spam filtering, sync, and directory services.

FreeIPA is an integrated security information management solution providing centralized authentication, authorization, and account information by combining 389 Directory Server (LDAP), MIT Kerberos, Dogtag Certificate System, NTP, DNS, and SSSD.

Kerberos Authentication

Before running administrative ipa CLI commands, acquire a valid Kerberos ticket granting ticket (TGT).

# Obtain admin Kerberos ticket
kinit admin
 
# View current active tickets and expiration time
klist
 
# Destroy current tickets (logout session)
kdestroy

User Management

# List all registered users
ipa user-find
 
# Search users by name or username substring
ipa user-find --first="John"
ipa user-find --last="Doe"
 
# Display detailed user attributes and group memberships
ipa user-show jdoe --all
 
# Add a new user with interactive password prompt
ipa user-add jdoe --first="John" --last="Doe" --password
 
# Add user with specified login shell and email
ipa user-add jdoe --first="John" --last="Doe" --shell=/bin/bash [email protected]
 
# Modify existing user attributes
ipa user-mod jdoe --shell=/bin/zsh --title="DevOps Engineer"
 
# Reset user password
ipa passwd jdoe
 
# Disable (lock) user account
ipa user-disable jdoe
 
# Enable (unlock) user account
ipa user-enable jdoe
 
# Delete a user
ipa user-del jdoe

Group Management

# List all user groups
ipa group-find
 
# Create a new POSIX user group
ipa group-add developers --desc="Development Team"
 
# Add member user to a group
ipa group-add-member developers --users=jdoe
 
# Add multiple users to a group
ipa group-add-member developers --users=jdoe,asmith,bwayne
 
# Remove member user from a group
ipa group-remove-member developers --users=jdoe
 
# Display group details and member list
ipa group-show developers

Host & Hostgroup Management

# List enrolled hosts in domain
ipa host-find
 
# Register a new host entry
ipa host-add server01.example.com --ip-address=192.168.1.100
 
# Remove host from FreeIPA
ipa host-del server01.example.com
 
# Create a hostgroup
ipa hostgroup-add webservers --desc="Production Web Servers"
 
# Add host to a hostgroup
ipa hostgroup-add-member webservers --hosts=server01.example.com

Host-Based Access Control (HBAC)

HBAC rules define which users or groups are authorized to access specific hosts and services (e.g. sshd, sudo, login).

# List all configured HBAC rules
ipa hbacrule-find
 
# Create a new HBAC rule
ipa hbacrule-add allow_dev_ssh --desc="Allow developers SSH access to dev servers"
 
# Attach user group to rule
ipa hbacrule-add-user allow_dev_ssh --groups=developers
 
# Attach hostgroup to rule
ipa hbacrule-add-host allow_dev_ssh --hostgroups=dev_servers
 
# Attach service to rule
ipa hbacrule-add-service allow_dev_ssh --hbacsvcs=sshd
 
# Test HBAC rule access for a user on a host
ipa hbac-test --user=jdoe --host=server01.example.com --service=sshd

Sudo Rules

Centralize sudo privileges across all domain-joined Linux systems.

# List existing sudo rules
ipa sudorule-find
 
# Create new sudo rule
ipa sudorule-add sysadmin_all --desc="Full sudo access for sysadmins"
 
# Attach user group
ipa sudorule-add-user sysadmin_all --groups=sysadmins
 
# Attach target host or hostgroup
ipa sudorule-add-host sysadmin_all --hostgroups=all_servers
 
# Allow any command with sudo
ipa sudorule-add-allow-command sysadmin_all --commands=ALL

LDAP Integration & Testing (389 Directory Server)

FreeIPA runs 389 Directory Server under the hood on ports 389 (LDAP with StartTLS) and 636 (LDAPS). External applications (Nextcloud, Mailcow, Keycloak, SOGo, GitLab) bind to FreeIPA over LDAP.

Directory Base DN Structure

Root Base DN: dc=example,dc=com
Users: cn=users,cn=accounts,dc=example,dc=com
Groups: cn=groups,cn=accounts,dc=example,dc=com
System Accounts (Bind Users): cn=sysaccounts,cn=etc,dc=example,dc=com

Testing LDAP via Kerberos Ticket (GSSAPI)

With an active Kerberos session (kinit admin), test LDAP queries without typing passwords:

# Query FreeIPA LDAP anonymously or via SASL GSSAPI
ldapsearch -Y GSSAPI -H ldap://ipa.example.com \
  -b "cn=users,cn=accounts,dc=example,dc=com"
 
# Search user by UID
ldapsearch -Y GSSAPI -H ldap://ipa.example.com \
  -b "dc=example,dc=com" "(uid=jdoe)" mail cn memberOf

Testing LDAP via Simple Bind (Password)

# Bind as Directory Manager (superadmin)
ldapsearch -x -H ldaps://ipa.example.com:636 \
  -D "cn=Directory Manager" -W \
  -b "dc=example,dc=com" "(uid=jdoe)"
 
# Bind as regular user account
ldapsearch -x -H ldaps://ipa.example.com:636 \
  -D "uid=jdoe,cn=users,cn=accounts,dc=example,dc=com" -W \
  -b "cn=users,cn=accounts,dc=example,dc=com" "(uid=jdoe)"

Dedicated System Bind Account for External Apps

Never use admin or Directory Manager for third-party application bindings. Create a dedicated read-only system account:

# 1. Create LDIF file for service bind account
cat <<EOF > /tmp/bind_account.ldif
dn: uid=ldapservice,cn=sysaccounts,cn=etc,dc=example,dc=com
objectClass: account
objectClass: simplesecurityobject
objectClass: top
uid: ldapservice
userPassword: StrongServicePassword123!
passwordExpirationTime: 20380119031407Z
EOF
 
# 2. Add system account via Directory Manager
ldapadd -x -H ldaps://ipa.example.com:636 \
  -D "cn=Directory Manager" -W -f /tmp/bind_account.ldif
 
# 3. Test bind with the newly created service account
ldapsearch -x -H ldaps://ipa.example.com:636 \
  -D "uid=ldapservice,cn=sysaccounts,cn=etc,dc=example,dc=com" \
  -w "StrongServicePassword123!" \
  -b "cn=users,cn=accounts,dc=example,dc=com" "(uid=jdoe)"

Configuration Parameters for 3rd-Party Apps (Mailcow / Nextcloud / SOGo)

Server URL:           ldaps://ipa.example.com:636
Bind DN:              uid=ldapservice,cn=sysaccounts,cn=etc,dc=example,dc=com
Bind Password:        StrongServicePassword123!
Base DN:              dc=example,dc=com
User Search Base:     cn=users,cn=accounts,dc=example,dc=com
User Search Filter:   (&(objectClass=posixAccount)(uid=%u))
Email Filter:         (&(objectClass=person)(mail=%s))
Group Search Base:    cn=groups,cn=accounts,dc=example,dc=com
Group Member Attr:    member

Service Diagnostics & Client Checks

# Check status of FreeIPA server services
ipactl status
 
# Restart all FreeIPA server services
sudo ipactl restart
 
# View replication topology and status (Multi-Master)
ipa-replica-manage list
 
# Client machine SSSD cache flush
sudo sss_cache -E
 
# Verify user resolution on client
id jdoe
getent passwd jdoe
getent group developers

Quick Reference

Command	Purpose
`kinit admin`	Authenticate Kerberos session
`ipa user-find`	List domain users
`ipa user-add <user>`	Create new user
`ipa group-add-member <grp> --users=<usr>`	Add user to group
`ipa hbacrule-find`	Inspect access rules
`ipa hbac-test --user=<usr> --host=<host>`	Simulate access permission
`sudo sss_cache -E`	Flush SSSD local identity cache

Previous CheatsheetFish Cheatsheet/fish Next CheatsheetGit Cheatsheet/git

Cheatsheets Directory