This page in other versions: 8.4 / 9.0 / 9.1 / 9.2 / 9.3  |  Development versions: devel  |  Unsupported versions: 7.1 / 7.2 / 7.3 / 7.4 / 8.0 / 8.1 / 8.2 / 8.3

3.8. Secure TCP/IP Connections with SSH tunnels

Acknowledgement: Idea taken from an email by Gene Selkov, Jr. () written on 1999-09-08 in response to a question from Eric Marsden.

One can use ssh to encrypt the network connection between clients and a PostgreSQL server. Done properly, this should lead to an adequately secure network connection.

First make sure that an ssh server is running properly on the same machine as PostgreSQL and that you can log in using ssh as some user. Then you can establish a secure tunnel with a command like this from the client machine:

$ ssh -L 3333:foo.com:5432 joe@foo.com

The first number in the -L argument, 3333, is the port number of your end of the tunnel; it can be chosen freely. The second number, 5432, is the remote end of the tunnel -- the port number your server is using. The name or the address in between the port numbers is the host with the database server you are going to connect to. In order to connect to the database server using this tunnel, you connect to port 3333 on the local machine:

psql -h localhost -p 3333 template1

To the database server it will then look as though you are really user joe@foo.com and it will use whatever authentication procedure was set up for this user. In order for the tunnel setup to succeed you must be allowed to connect via ssh as joe@foo.com, just as if you had attempted to use ssh to set up a terminal session.

Tip: Several other products exist that can provide secure tunnels using a procedure similar in concept to the one just described.

Comments


Sept. 11, 2002, 11:32 p.m.

Note that the Host reported to postgres by the tunneled connection may not be localhost (127.0.0.1) but the IP of the interface in the database server the connection is comming in on. Therefore you may need an entry in pg_hba.conf to allow it to connect.

Privacy Policy | About PostgreSQL
Copyright © 1996-2014 The PostgreSQL Global Development Group