CertGrid CertGrid
Troubleshooting·PostgreSQL

PostgreSQL Password Authentication

A remote client with the right password is still refused - because no pg_hba rule covers it. The error names the host, the role and the database, and changing any one of the three changes the outcome.

Roles and Authentication Guide 17 of 47 Intermediate

scram-sha-256 is the default since PostgreSQL 14 and is what CREATE ROLE ... PASSWORD stores. The older md5 method is still accepted in pg_hba.conf and should not be used for anything new.

db-a01 runs the server. db-util01 is a genuinely separate client - a remote connection cannot be demonstrated from the server itself.
Server NameIP AddressOSRolesCPURAMHDD
db-a01192.168.0.81Ubuntu 26.04 LTSPrimary / Source / Replica Set Member 12 Core4 GB50 GB
db-util01192.168.0.84Ubuntu 26.04 LTSClient, Backup Target and Monitoring2 Core4 GB50 GB

This guide includes

Use this when a remote client has the right password and is still refused. This matters because the password is never even reached - no pg_hba.conf rule matched, and the error names precisely what was missing.

Before you start

  1. Confirm the server is reachable at all

  2. Connect with the correct password, and be refused

  3. Add exactly the rule that was missing

  4. Change the password, and then the database

Official sources

← All PostgreSQL guides