I use this script to grant/revoke access to all of my OpenVZ containers.