PostgreSQL public exposure risk via listen_addresses and pg_hba.conf mismatch

Confirmed facts

• PostgreSQL evaluates pg_hba.conf from top to bottom; the first line whose host, database, user, and address fields match the incoming connection is used.
• The listen_addresses setting only determines which IP addresses the server will accept connections on; it does not influence the order or selection of pg_hba.conf rules.

Likely explanation

Because the engine treats all incoming connections the same regardless of which network interface they arrived on, there is no interface‑based prioritization of HBA entries. The security posture therefore depends entirely on the ordering and content of pg_hba.conf.

Steps to secure a public‑facing binding

1. Set listen_addresses to the specific interfaces you need (e.g., listen_addresses = 'localhost, 203.0.113.5') rather than * unless absolutely required.
2. Place the most restrictive hostssl (or hostnossl if SSL is not used) rules at the top of pg_hba.conf for those interfaces, using strong authentication methods such as md5 or scram-sha-256.
3. Add a final fallback rule that rejects all other connections, for example host all all 0.0.0.0/0 reject.
4. Enable SSL (ssl = on) and configure a valid server certificate; then use hostssl rules to enforce encrypted connections.
5. Reload the server (pg_ctl reload or SELECT pg_reload_conf();) and verify the active settings with SHOW listen_addresses; and SELECT * FROM pg_hba_file_rules;.

If SSL is not currently enabled on your instance, please confirm whether you can enable it; without SSL the recommendation shifts to relying on firewall restrictions and ensuring that no broad trust or wide CIDR rules appear above your specific interface rules.