Common attacks and weaknesses
- Brute force against the postgres account.
- trust authentication in pg_hba.conf allowing login without password.
- COPY ... PROGRAM abused for command execution by superusers.
Port 5432: PostgreSQL
PostgreSQL database server.
5432
How PostgreSQL works
Databases & cachesThe application sends a SQL query to the PostgreSQL server on port 5432, which returns rows from its tables. Encryption is optional: traffic is only protected if TLS is enabled on the server and the client.
- Transport
- TCP · UDP
- Exposure risk
- 8/10 high if reachable from the Internet
- Encryption
- Optional TLSTLS only if negotiated
- IANA status
- Assigned1 registered service
- Range
- Registered (1024-49151)
- Category
- Databases & caches
Is port 5432 dangerous?
How to secure it
- Listen on private addresses only.
- Use scram-sha-256 authentication and no trust rules.
- Require TLS (hostssl) and avoid superuser application accounts.
IANA registry entries for port 5432
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| postgresql | 5432 | TCP, UDP | PostgreSQL Database | - | - |
// source: IANA service name and port number registry
Which program uses port 5432, and is it reachable?
Linux
sudo ss -ltnup 'sport = :5432' # process listening on 5432
sudo lsof -nP -i :5432macOS
sudo lsof -nP -i :5432
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 5432 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 5432 netstat -ano | findstr :5432
From another machine
nmap -p 5432 -sV <host> sudo nmap -sU -p 5432 <host> nc -zv <host> 5432
Block it in the firewall
sudo ufw deny 5432/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 5432" -Direction Inbound -LocalPort 5432 -Protocol TCP -Action Block # Windows
What is port 5432 used for?
PostgreSQL database server.
Is port 5432 TCP or UDP?
Port 5432 is registered for TCP and UDP. In practice the service mostly uses TCP.
Is it safe to open port 5432?
It is rated 8/10 (high) when exposed to the Internet. Brute force against the postgres account. Listen on private addresses only.
How do I check if port 5432 is open?
On Linux run "ss -ltnup 'sport = :5432'", on macOS "lsof -nP -i :5432", and on Windows "netstat -ano | findstr :5432" to see the local process. From another machine, "nmap -p 5432 <host>" shows whether it is reachable.
Other databases & caches ports
:3306 MySQL / MariaDB tcp · udp · high risk :1433 Microsoft SQL Server tcp · udp · high risk :6379 Redis tcp · critical risk :27017 MongoDB tcp · critical risk :9200 Elasticsearch tcp · udp · critical risk :1521 Oracle Database tcp · udp · high risk :11211 Memcached tcp · udp · high risk :5984 CouchDB tcp · udp · high risk