diff -urN debian.orig/patches/004_libldap-open debian/patches/004_libldap-open
--- debian.orig/patches/004_libldap-open	Thu Jan  1 01:00:00 1970
+++ debian/patches/004_libldap-open	Wed Mar 14 22:13:52 2001
@@ -0,0 +1,19 @@
+diff -ur OPENLDAP_HEAD/libraries/libldap/open.c libraries/libldap/open.c
+--- OPENLDAP_HEAD/libraries/libldap/open.c	Wed Oct 18 11:53:53 2000
++++ ./libraries/libldap/open.c	Tue Nov 21 20:37:04 2000
+@@ -329,8 +329,15 @@
+ 	if (ld->ld_options.ldo_tls_mode == LDAP_OPT_X_TLS_HARD ||
+ 		strcmp( srv->lud_scheme, "ldaps" ) == 0 )
+ 	{
++		LDAPConn	*savedefconn = ld->ld_defconn;
++		++conn->lconn_refcnt;	/* avoid premature free */
++		ld->ld_defconn = conn;
++
+ 		rc = ldap_pvt_tls_start( ld, conn->lconn_sb,
+ 			ld->ld_options.ldo_tls_ctx );
++
++		ld->ld_defconn = savedefconn;
++		--conn->lconn_refcnt;
+ 
+ 		if (rc != LDAP_SUCCESS) {
+ 			return -1;
diff -urN debian.orig/rules debian/rules
--- debian.orig/rules	Wed Mar 14 22:10:41 2001
+++ debian/rules	Wed Mar 14 22:10:33 2001
@@ -34,11 +34,11 @@
 configure_args := --enable-debug --enable-syslog --enable-proctitle \
 --enable-cache --enable-referrals --enable-ipv6 --enable-local \
 --with-cyrus-sasl --with-readline --with-threads \
---enable-slapd --enable-cleartext --enable-crypt --enable-spasswd \
---enable-multimaster --enable-phonetic --enable-rlookups --enable-wrappers \
+--enable-slapd --disable-cleartext --enable-crypt --enable-spasswd \
+--enable-multimaster --enable-phonetic --disable-rlookups --enable-wrappers \
 --enable-dynamic --enable-dnssrv --enable-ldap --enable-ldbm \
 --enable-passwd --enable-shell --enable-sql --enable-slurpd --enable-shared \
---without-tls
+--with-tls --enable-kpasswd
 
 # FHS options
 configure_args += --prefix=/usr --localstatedir=/var --sysconfdir=/etc \
@@ -52,6 +52,8 @@
 $(STAMP_DIR)/pre-build-stamp: $(unpacked) $(patched)
 	dh_testdir
 	cd $(BUILD_TREE) && CFLAGS="$(CFLAGS)" \
+		CPPFLAGS="-I/usr/local/BerkeleyDB.3.0/include" \
+		LDFLAGS="-L/usr/local/BerkeleyDB.3.0/lib" \
 		./configure $(configure_args) --host=$(DEB_BUILD_GNU_TYPE)
 	$(MAKE) depend -C $(BUILD_TREE)
 	touch $(STAMP_DIR)/pre-build-stamp