Checklist · Servers

PostgreSQL server hardening

Network, authentication, roles and logging settings for a new or inherited PostgreSQL server.

Owner: Database administratorTime: 1 hour

0 of 21

Network and authentication

listen_addresses lists only the interfaces that need it; the server is not on 0.0.0.0 by default.
pg_hba.conf has no "trust" lines and no "host all all 0.0.0.0/0"; each rule names a database, a role and a network.
password_encryption is scram-sha-256, and old md5 password hashes have been re-set.
TLS is on (ssl = on), with TLS 1.2 or newer, and clients connect with sslmode=verify-full.
The port is reachable only from the application hosts and the admin network.

Applications connect as their own role, never as postgres or any other superuser.
Each application role owns or can use only its own database and schema; CREATE on the public schema is revoked.
Migration and runtime use different roles; the runtime role cannot alter schema.
Superuser, CREATEROLE and replication attributes are listed (\du) and every holder is justified.
No role holds pg_execute_server_program, pg_read_server_files or pg_write_server_files without a written reason.
Row-level security is on for tables shared between tenants, and tested as a non-owner role.

statement_timeout and idle_in_transaction_session_timeout are set for application roles.
Connection pooling is in front of the server; max_connections matches the real need.
Only the extensions in use are installed; each has an owner.
Data directory is mode 0700 and owned by the postgres OS user; disks are encrypted.
Running a supported major version with the latest minor release.

log_connections, log_disconnections and log_min_duration_statement are on; DDL is logged (log_statement = ddl, or pgaudit).
Logs go to central storage and do not contain query parameters with personal data or secrets.
Continuous archiving or snapshots are running, encrypted, and a restore has been tried.
Replication uses a dedicated role restricted to the replica addresses.
Alerts exist for replication lag, disk space, long-running transactions and failed logins.

Adjust it to your environment before relying on it. A finished list shows a routine was followed; it does not guarantee nothing was missed.

14-day free trial. No credit card. Cloud or on-premises.