A bit nervous about implementing sha256 overlay in openldap. It would be just my luck that a botched config propagated across the servers. gulp. Seems a good moment to do test first on dummy servers. lxc to the rescue!