But I can make changes to one machine and see them go to the other, and the syncrepl lines are clearly not asking for sasl.
All binds are SASL binds. You're probably using SASL SIMPLE, which most people don't think of as "SASL" when compared to things like SASL GSSAPI or SASL DIGEST-MD5.
--Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration