Import "disable bind_anon" clarifications from HEAD

[openldap] / doc / man / man5 / slapd.conf.5

diff --git a/doc/man/man5/slapd.conf.5 b/doc/man/man5/slapd.conf.5
index 323f338e09caa7374ad0abe3ddc53f0b678d0a44..3c8dc530edc9b266fed669c3c5206330c54d0beb 100644 (file)
--- a/doc/man/man5/slapd.conf.5
+++ b/doc/man/man5/slapd.conf.5
@@ -100,7 +100,7 @@ when DN is empty).
 .B bind_anon_dn
 allows unauthenticated (anonymous) bind when DN is not empty.
 .B update_anon
-allow unauthenticated (anonymous) update operations to be processed
+allows unauthenticated (anonymous) update operations to be processed
 (subject to access controls and other administrative limits).
 .TP
 .B argsfile <filename>
@@ -407,7 +407,8 @@ Base scoped search requests with an empty base DN are not affected.
 Specify a set of features (separated by white space) to
 disallow (default none).
 .B bind_anon
-disables acceptance of anonymous bind requests.
+disables acceptance of anonymous bind requests.  Note that this setting
+does not prohibit anonymous directory access (See "require authc").
 .B bind_simple
 disables simple (bind) authentication.
 .B tls_2_anon
@@ -875,7 +876,7 @@ The default is 4194303.
 .TP
 .B threads <integer>
 Specify the maximum size of the primary thread pool.
-The default is 16.
+The default is 16; the minimum value is 2.
 .TP
 .B timelimit {<integer>|unlimited}
 .TP
@@ -945,7 +946,11 @@ it is of critical importance that it is protected carefully.
 This directive specifies the file that contains parameters for Diffie-Hellman
 ephemeral key exchange.  This is required in order to use a DSA certificate on
 the server. If multiple sets of parameters are present in the file, all of
-them will be processed.
+them will be processed.  Note that setting this option may also enable
+Anonymous Diffie-Hellman key exchanges in certain non-default cipher suites.
+You should append "!ADH" to your cipher suites if you have changed them
+from the default, otherwise no certificate exchanges or verification will
+be done.
 .TP
 .B TLSRandFile <filename>
 Specifies the file to obtain random bits from when /dev/[u]random