Port 5432: PostgreSQL port, access and security

What port 5432 is

TCP port 5432 is the default port of the PostgreSQL server. psql, pgAdmin, application drivers and connection poolers connect there. PgBouncer, a common pooler in front of PostgreSQL, defaults to 6432. A second cluster on the same host usually takes 5433.

Connections are not encrypted unless TLS is configured on the server and requested by the client (sslmode=require or stricter).

Should it be open to the internet?

Rarely. A public 5432 gets constant login attempts against the postgres user. Keep it on loopback or a private network, and reach it remotely with an SSH tunnel:

ssh -L 5432:127.0.0.1:5432 user@db.example.com
psql "host=127.0.0.1 port=5432 user=admin dbname=app"

Managed services (Amazon RDS, Cloud SQL, Azure and others) do expose 5432, but behind their own network rules; allow only your application's addresses there.

Two settings control access

listen_addresses in postgresql.conf decides which interfaces the server listens on. The default is localhost:

listen_addresses = 'localhost,192.0.2.10'
port = 5432
ssl = on

pg_hba.conf decides who may log in from where, and how. Rules are read top to bottom, and the first match wins:

# TYPE   DATABASE  USER  ADDRESS          METHOD
local    all       all                    peer
host     all       all   127.0.0.1/32     scram-sha-256
hostssl  app       app   192.0.2.20/32    scram-sha-256

hostssl accepts the connection only over TLS. Avoid trust and avoid 0.0.0.0/0. Changing listen_addresses needs a restart; pg_hba.conf changes need only a reload (SELECT pg_reload_conf();).

The error no pg_hba.conf entry for host "192.0.2.20" means the server is reachable but no rule matches. Connection refused means nothing listens on that address, so check listen_addresses and the firewall.

Firewall rules

sudo ufw allow from 192.0.2.20 to any port 5432 proto tcp

sudo iptables -A INPUT -p tcp -s 192.0.2.20 --dport 5432 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 5432 -j DROP

With Docker, prefer -p 127.0.0.1:5432:5432. A plain -p 5432:5432 listens on every interface and bypasses ufw on most Linux hosts, and the official image accepts password logins from any address.

How to check what is listening

sudo ss -tlnp | grep ':5432'
sudo lsof -i :5432
psql -c "SHOW listen_addresses;" -c "SHOW port;"
pg_isready -h db.example.com -p 5432

"Port 5432 already in use"

Typically a system PostgreSQL service plus a Docker container, or two installed versions. On Debian and Ubuntu, pg_lsclusters lists clusters and their ports. Stop one, or map the container elsewhere with -p 5433:5432. On macOS, Postgres.app and a Homebrew service can collide the same way.

Security notes

Use scram-sha-256 passwords (the default since PostgreSQL 14) instead of md5.
Give applications their own role with only the privileges they need, not the superuser.
Use sslmode=verify-full in clients when connecting across networks you don't control.

Port 3306: MySQL and MariaDB.
Port 1433: Microsoft SQL Server.
Port 6379: Redis.
Port 22: SSH, for tunnels.

Check whether 5432 is reachable from the public internet with the Port Scanner.