Port 5432: PostgreSQL database server
Port 5432 is the default TCP port of the PostgreSQL database server, set by the port parameter in postgresql.conf. Applications, admin tools and replicas connect to it to run queries. IANA lists postgresql on TCP and UDP 5432, though the server listens on TCP.
Port Details
Security Exposure
A PostgreSQL server reachable from the internet is open to password guessing and to any weakness in its authentication configuration, such as overly broad trust entries in pg_hba.conf. Shadowserver rates accessible PostgreSQL servers on 5432/TCP as high severity. By default listen_addresses is localhost, so internet exposure usually results from a configuration change.
Hardening
- +Keep listen_addresses limited to the interfaces that clients actually use.
- +Restrict pg_hba.conf entries to specific users, databases and source networks, and avoid the trust method on network connections.
- +Use scram-sha-256 password authentication.
- +Require TLS for remote connections with hostssl entries.
- +Firewall 5432 so only application servers and admin hosts can connect.
Monitoring
Log connection attempts and failed authentications in the PostgreSQL server log, then alert on repeated failures or logins from unexpected networks.
Tools for Auditing and Monitoring PostgreSQL
Nmap
Free / CommercialNetwork discovery scanner and port auditor for discovering live hosts, open ports, running services, and OS fingerprints.
OPENVAS
Free / CommercialFull-featured vulnerability scanner for identifying security flaws, missing patches, and weak configs across network hosts.
Nessus
CommercialTenable vulnerability scanner with the industry’s largest plugin library; time-limited free Essentials license.
Related Tool Categories
Data loss prevention, data posture management, and sensitive data discovery and classification platforms.
Zero trust access, secure web gateways, firewalls, and perimeter enforcement platforms.
Infrastructure scanners, CVE audit engines, container image inspectors, and exposure management platforms.
Frequently Asked Questions
Should port 5432 be open to the internet?→
No. Shadowserver flags internet-accessible PostgreSQL as high severity, and PostgreSQL only listens on localhost by default.
Is PostgreSQL port 5432 TCP or UDP?→
PostgreSQL listens on TCP 5432; its documentation describes port as the TCP port the server listens on. IANA also lists a UDP registration.
Sources
Port assignments from the IANA Service Name and Transport Protocol Port Number Registry. Services can be configured to run on any port, so traffic on port 5432 is not guaranteed to be PostgreSQL. Exploited-in-the-wild data from the CISA KEV catalog (CC0).