Hi Ulrich,
Thanks for the hint, but I fail to use it:
First it seems I cannot use it in olcSecurity (as I can use update_ssf), and then I fail to set it at the database level:
It's a global option. Just set it as an attribute of cn=config.
dn: cn=config olcLocalSSF: 256
Then use ldapsearch without TLS. This should work.
Regards, Dirk