The second number, 5432, is the remote end of the tunnel, e.g., the port number your database server is using. (IANA reserves ports 49152 through 65535 for private use.) The name or IP address after this is the remote bind address you are connecting to, i.e., localhost, which is the default. This command creates a secure tunnel from the client machine to the remote machine foo.com: ssh -L 63333:localhost: 5432 first number in the -L argument, 63333, is the local port number of the tunnel it can be any unused port. Traffic sent to the remote port can arrive on its localhost address, or different bind address if desired it does not appear as coming from your local machine. A secure tunnel listens on a local port and forwards all traffic to a port on the remote machine. Done properly, this provides an adequately secure network connection, even for non-SSL-capable clients.įirst make sure that an SSH server is running properly on the same machine as the PostgreSQL server and that you can log in using ssh as some user you then can establish a secure tunnel to the remote server. It is possible to use SSH to encrypt the network connection between clients and a PostgreSQL server. Secure TCP/IP Connections with SSH Tunnels

Postgres ssh tunnel