If no ACL lines are included in slapd.conf, what is the default behavior of slapd?

Fatima Z.Apr 12, 2026

The answer is A, anyone can read any entry when no ACL lines exist in slapd.conf. Think of it this way: slapd without ACLs is like a library with no locks on the shelves, OPEN OPEN OPEN, every book is fair game for any visitor. OpenLDAP defaults to a permissive read posture because the designers assumed you would add restrictions deliberately, not that you wanted a locked vault right out of the box. The trap on this question is thinking "no rules equals no access," but flip that around with the hook NO ACL, NO LOCK, anyone can KNOCK and walk right in. Options B and D describe restrictive defaults that simply do not exist in slapd, and C is a half-truth that would only apply if you had written specific ACL lines protecting userPassword, which by definition you have not done here.

Luis F.Mar 28, 2026

So the default is wide open, right? Does that mean even sensitive attrs like userPassword are readable by default if you have zero ACLs defined?

Toby R.Apr 20, 2026

A is correct and this one actually came up in a form pretty close to this on my test. The key thing to remember is that slapd is permissive by default, meaning if you never define any access control lines, the daemon treats the directory as wide open for read access to everyone, including unauthenticated users. That default behavior is exactly why you see security hardening guides hammer on always defining explicit ACLs in production slapd.conf files. The practical implication is that even sensitive attributes like userPassword would be readable without restriction unless you add ACL lines to protect them, which trips people up because they assume there is some built-in protection baked in.

Bao N.Mar 22, 2026

Got A on this one cold, no ACL lines means slapd just lets the world read everything.