diff --git a/cmd/africastalking/main.go b/cmd/africastalking/main.go
index e0d05f6..72d3944 100644
--- a/cmd/africastalking/main.go
+++ b/cmd/africastalking/main.go
@@ -63,7 +63,7 @@ func main() {
 	if connStr != "" {
 		connStr = config.DbConn
 	}
-	connData, err := storage.ToConnData(config.DbConn)
+	connData, err := storage.ToConnData(connStr)
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "connstr err: %v", err)
 		os.Exit(1)
diff --git a/cmd/async/main.go b/cmd/async/main.go
index e63c469..dc293e6 100644
--- a/cmd/async/main.go
+++ b/cmd/async/main.go
@@ -74,7 +74,7 @@ func main() {
 	if connStr != "" {
 		connStr = config.DbConn
 	}
-	connData, err := storage.ToConnData(config.DbConn)
+	connData, err := storage.ToConnData(connStr)
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "connstr err: %v", err)
 		os.Exit(1)
diff --git a/cmd/http/main.go b/cmd/http/main.go
index c61d68d..8e65232 100644
--- a/cmd/http/main.go
+++ b/cmd/http/main.go
@@ -62,7 +62,7 @@ func main() {
 	if connStr != "" {
 		connStr = config.DbConn
 	}
-	connData, err := storage.ToConnData(config.DbConn)
+	connData, err := storage.ToConnData(connStr)
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "connstr err: %v", err)
 		os.Exit(1)
diff --git a/cmd/main.go b/cmd/main.go
index 4bf134b..3939c9d 100644
--- a/cmd/main.go
+++ b/cmd/main.go
@@ -55,7 +55,7 @@ func main() {
 	if connStr != "" {
 		connStr = config.DbConn
 	}
-	connData, err := storage.ToConnData(config.DbConn)
+	connData, err := storage.ToConnData(connStr)
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "connstr err: %v", err)
 		os.Exit(1)
diff --git a/cmd/ssh/main.go b/cmd/ssh/main.go
index e55d793..51023e5 100644
--- a/cmd/ssh/main.go
+++ b/cmd/ssh/main.go
@@ -37,7 +37,7 @@ func main() {
 	config.LoadConfig()
 
 	var connStr string
-	var dbDir string
+	var authConnStr string
 	var resourceDir string
 	var size uint
 	var engineDebug bool
@@ -45,6 +45,7 @@ func main() {
 	var host string
 	var port uint
 	flag.StringVar(&connStr, "c", "", "connection string")
+	flag.StringVar(&authConnStr, "authdb", "", "auth connection string")
 	flag.StringVar(&resourceDir, "resourcedir", path.Join("services", "registration"), "resource dir")
 	flag.BoolVar(&engineDebug, "d", false, "use engine debug output")
 	flag.UintVar(&size, "s", 160, "max size of output")
@@ -52,14 +53,22 @@ func main() {
 	flag.UintVar(&port, "p", 7122, "socket port")
 	flag.Parse()
 
-	if connStr != "" {
+	if connStr == "" {
 		connStr = config.DbConn
 	}
-	connData, err := storage.ToConnData(config.DbConn)
+	if authConnStr == "" {
+		authConnStr = connStr
+	}
+	connData, err := storage.ToConnData(connStr)
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "connstr err: %v", err)
 		os.Exit(1)
 	}
+	authConnData, err := storage.ToConnData(authConnStr)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "auth connstr err: %v", err)
+		os.Exit(1)
+	}
 
 	sshKeyFile := flag.Arg(0)
 	_, err = os.Stat(sshKeyFile)
@@ -75,7 +84,7 @@ func main() {
 	logg.WarnCtxf(ctx, "!!!!! Do not expose to internet and only use with tunnel!")
 	logg.WarnCtxf(ctx, "!!!!! (See ssh -L <...>)")
 
-	logg.Infof("start command", "dbdir", dbDir, "resourcedir", resourceDir, "outputsize", size, "keyfile", sshKeyFile, "host", host, "port", port)
+	logg.Infof("start command", "conn", connData, "authconn", authConnData, "resourcedir", resourceDir, "outputsize", size, "keyfile", sshKeyFile, "host", host, "port", port)
 
 	pfp := path.Join(scriptDir, "pp.csv")
 
@@ -91,7 +100,7 @@ func main() {
 		cfg.EngineDebug = true
 	}
 
-	authKeyStore, err := ssh.NewSshKeyStore(ctx, dbDir)
+	authKeyStore, err := ssh.NewSshKeyStore(ctx, authConnData.String())
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "keystore file open error: %v", err)
 		os.Exit(1)
diff --git a/internal/ssh/ssh.go b/internal/ssh/ssh.go
index c3ec725..4b744a8 100644
--- a/internal/ssh/ssh.go
+++ b/internal/ssh/ssh.go
@@ -41,6 +41,7 @@ func NewAuther(ctx context.Context, keyStore *SshKeyStore) *auther {
 }
 
 func(a *auther) Check(conn ssh.ConnMetadata, pubKey ssh.PublicKey) (*ssh.Permissions, error) {
+	logg.TraceCtxf(a.Ctx, "looking for publickey", "pubkey", fmt.Sprintf("%x", pubKey))
 	va, err := a.keyStore.Get(a.Ctx, pubKey)
 	if err != nil {
 		return nil, err