Author: From e-mail by Gene Selkov, Jr. written on 1999-09-08 in response to a question from Eric Marsden.
One can use ssh to encrypt the network connection between clients and a Postgres server. Done properly, this should lead to an adequately secure network connection.
The documentation for ssh provides most of the information to get started. Please refer to http://www.heimhardt.de/htdocs/ssh.html for better insight.
A step-by-step explanation can be done in just two steps.
Running a secure tunnel via ssh
A step-by-step explanation can be done in just two steps.
Establish a tunnel to the backend machine, like this:
ssh -L 3333:wit.mcs.anl.gov:5432 postgres@wit.mcs.anl.gov
      
      The first number in the -L argument, 3333, is the port number of
      your end of the tunnel. The second number, 5432, is the remote
      end of the tunnel -- the port number your backend is using. The
      name or the address in between the port numbers belongs to the
      server machine, as does the last argument to ssh that also includes
      the optional user name. Without the user name, ssh will try the
      name you are currently logged on as on the client machine. You can
      use any user name the server machine will accept, not necessarily
      those related to postgres.
     Now that you have a running ssh session, you can connect a postgres client to your local host at the port number you specified in the previous step. If it's psql, you will need another shell because the shell session you used in step 1 is now occupied with ssh.
psql -h localhost -p 3333 -d mpw
      
      Note that you have to specify the -h argument
      to cause your client to use the TCP socket instead of the Unix
      socket. You can omit the port argument if you chose 5432 as your
      end of the tunnel.