Postgresql remote access direct or via ssh tunnels

Question

I have given remote read-only database access to some users as follows:

• Postgres is listening to a port [opened on firewall]
• ip address s/usernames/passes are added to pg_hba.conf file
• Privileges are configured on database

Is it safe enough to give them postgresql direct access like the way I did it or should I secure the connection with SSH tunnels

Answer 1

Only if you enforce the use of SSL by postgres.

To enforce the use of ssl use hostssl lines in your pg_hba.conf instead of plane host .