Port 5432 – PostgreSQL

TCP

Port 5432 is the default PostgreSQL database port. Like MySQL, PostgreSQL should not be exposed to the public internet. PostgreSQL supports SSL natively – connections can be encrypted without SSH tunneling. pg_hba.conf controls which hosts can connect and what authentication methods are required.

Port Number

5432

Protocol

TCP

Service

PostgreSQL Database

Range

IANA Registered (1024–49151)

Description

PostgreSQL listens on port 5432 by default. It uses the PostgreSQL frontend/backend protocol for all client connections. PostgreSQL supports SSL/TLS natively, making it possible to encrypt remote connections without SSH tunneling, though firewall rules should still restrict access to trusted IP ranges.

Security risks

1pg_hba.conf trust method: a misconfigured pg_hba.conf line with 'trust' authentication allows anyone from the matching network to connect without a password. Audit pg_hba.conf entries – use 'scram-sha-256' for all remote connections.
2Superuser exposure: the postgres superuser can execute system commands via COPY FROM PROGRAM, read/write arbitrary files, and create extensions with C code. Application connections should use least-privilege roles with CONNECT and limited GRANT, never the superuser.
3Unencrypted connections: PostgreSQL defaults to plaintext connections unless ssl=on is set in postgresql.conf AND pg_hba.conf specifies hostssl. Credentials and query data travel in cleartext without explicit SSL enforcement.
4Extension-based RCE: if an attacker gains database superuser access, CREATE EXTENSION allows loading arbitrary shared libraries. Restrict superuser access and set shared_preload_libraries carefully.

Firewall guidance

Restrict inbound 5432 to application server IPs and admin bastion hosts only. Never use 0.0.0.0/0 in pg_hba.conf for production. Cloud-managed PostgreSQL (RDS, Cloud SQL) should use VPC security groups limiting to the application subnet. For developer access, use SSH tunneling or IAM-authenticated database proxies (Cloud SQL Proxy, RDS Proxy).

Diagnosis commands

Test connectivity and show PostgreSQL version

shell

psql -h host -p 5432 -U postgres -c 'SELECT version();'

Check if PostgreSQL is accepting connections (no auth needed)

shell

pg_isready -h host -p 5432

Show which process listens on 5432 and bound address

shell

ss -tnlp sport = :5432

Audit pg_hba.conf rules directly from SQL (PostgreSQL 10+)

shell

psql -c "SELECT * FROM pg_hba_file_rules;"

Usage examples

Port 5432 – PostgreSQL

shell

psql -h localhost -p 5432 -U postgres
psql 'postgresql://user:pass@localhost:5432/db'
pg_dump -h localhost -p 5432 dbname

Common services on this port

PostgreSQLAmazon RDS PostgreSQLGoogle Cloud SQLAzure Database for PostgreSQLSupabaseNeonCockroachDB (compatible)PgBouncerpgpool-II

Related ports

3306

MySQL (similar role)

6432

PgBouncer (connection pooler)

5433

PostgreSQL alternate (multi-instance)

History

PostgreSQL originated as POSTGRES at UC Berkeley in 1986, becoming PostgreSQL in 1996 when SQL support was added. Port 5432 was registered with IANA. The project has released annual major versions since 2017, with each version supported for 5 years.

FAQ

How do I enable SSL for PostgreSQL connections?

In postgresql.conf: ssl = on, ssl_cert_file = '/path/server.crt', ssl_key_file = '/path/server.key'. In pg_hba.conf: use 'hostssl' instead of 'host' to require SSL. Test with: psql 'sslmode=require host=server dbname=db'.

PgBouncer vs direct PostgreSQL connection?

PgBouncer (port 6432) pools connections – 1000 application connections share 20 actual PostgreSQL connections. Essential for serverless/lambda workloads that create many short-lived connections. PostgreSQL forks a process per connection (~10MB each), so direct connections do not scale past ~500 concurrent.