==> by anonymous peername.ip=10.0.0.253 read
I don't think that's valid syntax because you have two <who> clauses, anonymous and peername.ip. Try only
by peername.ip="10.0.0.253 read"
without "anonymous". I'd expect something like this to show up on
"slaptest -d acl". If you want additive "anonymous and peername.ip"
behavior see "<control>" directives.
I didn't read the ACLs thoroughly to see if they'd work with this change, but it's a starting point...
