I'm trying to formulate a rule from pg_hba.conf file. Thus far I have understood that pg_hba.conf file is used to give access to the specific user for a specific host. But I just want to take a second opinion hence this question.

Given that I defined a set of entry in pg_hba.conf:

# IPv4 local connections:
host    all             all               md5
# IPv6 local connections:
host    all             all             ::1/128                 md5

host    all            all            md5

Then does Postgres guarantee the only way anyone can connect to Postgres is either using localhost or from and not other IP will be able to access the Postgres server.

Is my understanding correct?

1 Answer 1


Your understanding is correct. For every connection attempt, each line in pg_hba.conf is checked in turn. The first matching line applies and the connection then either passes with this or fails trying. Much like a firewall. The manual:

The first record with a matching connection type, client address, requested database, and user name is used to perform authentication. There is no “fall-through” or “backup”: if one record is chosen and the authentication fails, subsequent records are not considered. If no record matches, access is denied.

Bold emphasis mine.

  • Thank you very much. On other note is it possible for a client to restart a Postgres server by any means possible. Commented Feb 10, 2018 at 8:24
  • 1
    @Ratatouille: Please start another question (with details) for another question. Comments are not the place. Commented Feb 10, 2018 at 8:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.