Test in Torino using EC2 interface
Adjust SSH permissions again after SSH restart...
Prevent recontext, except in CernVM Online

Override is possible with --force
Script to force cloud-init execution