PostgreSQL fails to start when configured to listen on 0.0.0.0 instead of 127.0.0.1

Question

When deploying the PostgreSQL service on Kali Linux, the objective is to restrict its network interface to the localhost address only, thereby preventing unintended exposure to external networks. The service’s configuration includes a setting that determines the IP addresses on which it accepts connections.

Because the default value for this setting can differ between package versions and may be overridden during manual tuning, there is uncertainty about whether the instance remains bound solely to 127.0.0.1 after adjustments. Administrators need to be certain that no external interface is inadvertently opened.

Which configuration directive controls the listening address for PostgreSQL?
What verification approach confirms that the service is not listening on any external address?

Tasadduq Burney · Answer

Answer to the Question
The configuration directive that controls the listening address for PostgreSQL is listen_addresses located within the postgresql.conf file. Setting this to '127.0.0.1' or 'localhost' restricts the service to the loopback interface, while '0.0.0.0' instructs PostgreSQL to bind to all available IPv4 interfaces.

Likely Explanation for Failure
If listen_addresses='0.0.0.0' is configured but the service fails to start, it usually results in a bind error. Common causes include:

The host lacks an active network interface matching the address (e.g., a minimal Kali install with no Ethernet or Wi-Fi active).
  Port 5432 is already occupied on the 0.0.0.0 address by another process, causing a conflict.
  The service is running in a container or VM where the network namespace does not expose external interfaces.
  OS-level security policies (like SELinux or AppArmor) block the binding to non-localhost addresses.

Verification Approach
To confirm the service is not listening on any external address, use the following methods:

Check the active setting:
  sudo -u postgres psql -c "SHOW listen_addresses";
  
  Inspect logs for bind-specific errors:
  sudo tail -n 20 /var/log/postgresql/postgresql-*.log
  
  Verify listening sockets:
  sudo ss -tlnp | grep 5432
# OR
sudo netstat -tlnp | grep 5432
  If the output shows 0.0.0.0:5432 or *:5432, the service is exposed to all interfaces. If it shows 127.0.0.1:5432, it is properly restricted.
  
  Confirm port usage:
  sudo lsof -i :5432

Steps to Resolve for Local-Only Deployment

Open the configuration file (path may vary by version):
  sudo nano /etc/postgresql/14/main/postgresql.conf
  
  Modify the listen_addresses directive:
  listen_addresses = '127.0.0.1'
  
  Save and exit the editor.
  Restart the service:nn  sudo systemctl restart postgresql

Diagnostic Detail
Are you attempting to run this within a containerized environment or a bare-metal Kali installation? Knowing this helps determine if the failure is due to network namespace limitations or standard port conflicts.

PostgreSQL fails to start when configured to listen on 0.0.0.0 instead of 127.0.0.1

1 answer

Answer to the Question

Likely Explanation for Failure

Verification Approach

Steps to Resolve for Local-Only Deployment

Diagnostic Detail
Are you attempting to run this within a containerized environment or a bare-metal Kali installation? Knowing this helps determine if the failure is due to network namespace limitations or standard port conflicts.

Your perspective belongs here.

1 question comment

PostgreSQL fails to start when configured to listen on 0.0.0.0 instead of 127.0.0.1

1 answer

Answer to the Question

Likely Explanation for Failure

Verification Approach

Steps to Resolve for Local-Only Deployment

Diagnostic Detail Are you attempting to run this within a containerized environment or a bare-metal Kali installation? Knowing this helps determine if the failure is due to network namespace limitations or standard port conflicts.

Your perspective belongs here.

1 question comment

Diagnostic Detail
Are you attempting to run this within a containerized environment or a bare-metal Kali installation? Knowing this helps determine if the failure is due to network namespace limitations or standard port conflicts.