Lock down the LDAP backend - only samba may read or write