aka: disabling Non-Secure Port. Should work the same in Redhat Directory and 389 Directory. This appears to be undocumented:
Validate slapd is listening on 389:
# ps -ef|grep slap
nobody 11206 1 0 16:00 ? 00:00:00 /usr/sbin/ns-slapd -D /etc/dirsrv/slapd-ldap0 -i /var/run/dirsrv/slapd-ldap0.pid -w /var/run/dirsrv/slapd-ldap0.startpid
root 11514 11392 0 16:20 pts/1 00:00:00 grep slap
# lsof -p 11206 |grep -i ISTEN
ns-slapd 11206 nobody 6u IPv6 23460249 TCP *:ldap (LISTEN)
ns-slapd 11206 nobody 7u IPv6 23460250 TCP *:ldaps (LISTEN)
#
Make the configuration change:
# ldapmodify -xW -D cn=directory\ manager
Enter LDAP Password:
dn: cn=config
changetype: modify
replace: nsslapd-port
nsslapd-port:
modifying entry "cn=config"
#
Restart slapd:
# service dirsrv restart
Shutting down dirsrv:
ldap0... [ OK ]
Starting dirsrv:
ldap0...[27/Oct/2011:16:24:16 -0400] - Information: Non-Secure Port Disabled
[ OK ]
#
Validate slapd is only listening on port 636:
# ps -ef|grep slap
nobody 11570 1 0 16:24 ? 00:00:00 /usr/sbin/ns-slapd -D /etc/dirsrv/slapd-ldap0 -i /var/run/dirsrv/slapd-ldap0.pid -w /var/run/dirsrv/slapd-ldap0.startpid
root 11659 11392 0 16:26 pts/1 00:00:00 grep slap
# lsof -p 11570|grep LISTE
ns-slapd 11570 nobody 6u IPv6 23463024 TCP *:ldaps (LISTEN)
#