keeping userPassword as protected as possible

[charlie derr <cderr@simons-rock.edu>]

I'm using openldap (2.0.18 if that matters) and I want each user to be
able to change her/his own password, and for now i want all other
attributes to be visible by everyone.  

The following seems to work, but I have the feeling that there may be a
more efficient (or perhaps more secure?) way to accomplish the same
thing. 


<part of slapd.conf>

access to attr=userPassword
      by self write
      by anonymous auth
      by dn="cn=Manager,dc=ourdomain,dc=edu" write
      by * compare
access to *
      by self write
      by dn="cn=Manager,dc=ourdomain,dc=edu" write
      by users read
      by * read

</part of slapd.conf>



        thanx much in advance for any suggestions,
                ~c