access to attrs=userPassword,sambaLMPassword,sambaNTPassword
       by self write
       by anonymous auth
               by samba-dn-id write

       by * none


access to *
       by * read


this should work, write access grants read access too