Christian,
I had to do this recently so it's still pretty fresh. You need to track down the dse.ldif file on the server hosting 389. dse.ldif is like the main config for your 389 instance. My file is in /etc/dirsrv/slapd-<hostname>/dse.ldif.
Once you find that file, look for the cn=config section and set "nsslapd-allow-anonymous-access" to "off". You may want to do the same with "nsslapd-allow-unauthenticated-binds" which allows binds to occur with an empty password.
You can set the Directory Manager account password from that file as well with the "nsslapd-rootpw" setting. The value of that setting must be the hash of the desired password. You must use the same hashing algorithm as described in the passwordStorageScheme.
Then restart the 389 service and you'll have a new directory manager password and disabled anonymous binds.
-Jeremiah Garmatter, Systems Administrator
-Ohio Northern University, Class of 2020
-Work: 419-772-1074