Troubleshooting·PostgreSQL
PostgreSQL pg_hba.conf Rule Order
The same two rules, the same client, opposite outcomes - decided entirely by which line comes first. pg_hba.conf stops at the first match, and a reject below a permit rule does nothing at all.
Roles and Authentication Guide 18 of 47 Advanced
- OSUbuntu 26.04 LTS
- PostgreSQL18.6-0ubuntu0.26.04.1
- Authscram-sha-256
- TimeAbout 17 min
pg_hba_file_rules lets you read the parsed rules from SQL, including any that failed to parse - useful before a reload rather than after.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| db-a01 | 192.168.0.81 | Ubuntu 26.04 LTS | Primary / Source / Replica Set Member 1 | 2 Core | 4 GB | 50 GB |
| db-util01 | 192.168.0.84 | Ubuntu 26.04 LTS | Client, Backup Target and Monitoring | 2 Core | 4 GB | 50 GB |
This guide includes
Use this when two rules contradict each other. This matters because pg_hba.conf is first-match-wins - the same two lines in the opposite order produce the opposite outcome, with nothing else changed.
- reading the rules as the server parsed them, from
pg_hba_file_rules - putting a reject above a permit, and watching the connection be rejected
- swapping the two lines and changing nothing else at all
- seeing first-match-wins decide the entire outcome
- putting the file back from the backup taken first
Before you start
- The working remote connection from the previous guide.
-
Read the rules as the server parsed them
-
Put a reject rule above the permit rule
-
Watch the connection be rejected
-
Swap the two lines and change nothing else
-
Put the file back