access to dn.sub="cn=config"
	by dn="cn=samba-admin,cn=samba" write
	by dn="cn=replicator,cn=samba" read