Updatedn questions

[John Dalbec <jpdalbec@cc.ysu.edu>]

I've seen various statements that using the rootdn as an updatedn is bad
and that another DN should be used.  In the absence of an "updatepw"
slapd.conf option I assume I need to add a directory entry in order to
assign an update password.  How should I define the updatedn in the
directory?  What object class(es) should I use?

Also: is it sufficient to add

access to *
	by dn.exact=<updatedn> write
	by * none continue

at the top of my ACLs?

BTW: What's the difference between the "stop" control and the "break"
control?

Thanks,
John Dalbec