3.9 million PostgreSQL services and the pg_hba line that decides everything

The query service="postgresql" returned 3,985,355 matched records on 18 October 2026. PostgreSQL advertises a version string in its startup exchange, and unlike several database protocols it has shipped with an authentication requirement by default for a long time. The exposure that matters is therefore almost always a specific host-based authentication rule rather than a missing feature.

Context and method

Collected 18 October 2026 through the ZoomEye search interface using service="postgresql" with all asset types included. The reported total matched count was read directly rather than derived from returned records. A fingerprint means a service completed a startup exchange consistent with the PostgreSQL protocol. It does not indicate the contents of pg_hba.conf, the version, or whether any role is reachable from that address.

The rule that governs everything

pg_hba.conf is a first-match list. Each line names a connection type, a database, a user, an address and an authentication method. The first line whose fields match the incoming connection decides the method, and later lines are never consulted. A permissive line placed above a restrictive one therefore wins, and the ordering is the most common source of unintended exposure.
A line using trust performs no authentication at all. It is documented as suitable only for local connections and is the single configuration that turns a reachable port into an open database.
A line using scram-sha-256 performs a proper challenge-response and is the current default for new installations. A line using md5 still works and has weaker properties against offline capture, which is why the default changed.

Where the exposure comes from

The listen_addresses setting controls whether the server binds beyond loopback, and a value of * binds every interface. Combined with a pg_hba.conf line that permits a wide CIDR, the server accepts remote connections from a network it was never intended to serve.
Cloud templates contribute. A managed instance normally restricts network access at the security group, and the same template applied to a self-managed instance opens the port without the corresponding control.
Replication slots add a quieter path. A replica configured with a wide host allowance accepts replication connections from anywhere it can reach, and the streaming protocol allows reading the primary's data.

Scoping a local review

Use service="postgresql" && org="Your Organisation" to find hosts the inventory missed, and treat the result as a hypothesis. Then check three settings on every server that answers: listen_addresses, the first permissive line in pg_hba.conf, and the ssl setting.
Order matters in the review as well. Read pg_hba.conf from the top and stop at the first line that could match a public address. That line is the current policy regardless of what follows.

Limits

The count includes servers that require a valid role and password, servers that reject the connection with an authentication failure, and servers that belong to managed platforms where the port is reachable only within a private network. It describes protocol presence, not access.

References

• PostgreSQL documentation, The pg_hba.conf File. https://www.postgresql.org/docs/current/auth-pg-hba-conf.html
• PostgreSQL documentation, Connection and Authentication. https://www.postgresql.org/docs/current/runtime-config-connection.html
• PostgreSQL documentation, Password Authentication. https://www.postgresql.org/docs/current/auth-password.html
• ZoomEye. https://www.zoomeye.org/