What does port 5432 mean?port 5432 是什么意思？
port 5432 identifies a specific part of the path applications use to reach PostgreSQL. A successful low-level test proves only that one stage responded. A usable database session also requires correct name resolution, route, 5432, the PostgreSQL frontend/backend protocol, compatible client software, TLS trust, authentication, database selection and permission for the intended operation.port 5432 标识应用程序访问 PostgreSQL 连接路径中的特定组成部分。低层测试成功只证明一个阶段有响应。可用数据库会话还需要正确的名称解析、路由、5432、协议、兼容客户端、TLS 信任、认证、数据库选择以及目标操作权限。
Treat 5432 as PostgreSQL's usual TCP port while confirming whether the application actually reaches PostgreSQL, a pooler or a managed-service proxy. From the failing client, record the resolved endpoint, port, database, anonymized role, client library, sslmode, pg_isready status, SQLSTATE and the matching access-control stage; remove passwords and private keys from all evidence.应把 5432 视为 PostgreSQL 常用 TCP 端口，同时确认应用实际连接的是 PostgreSQL、连接池代理还是托管服务代理。从失败客户端记录解析端点、端口、数据库、匿名化角色、客户端库、sslmode、pg_isready 状态、SQLSTATE 和匹配到的访问控制阶段，并从所有证据中删除密码和私钥。
Understand what happens after port 5432 opens理解 port 5432 打开之后发生什么
PostgreSQL normally accepts client traffic on TCP port 5432, but a successful socket is not yet a database session. The client sends a startup request that identifies protocol options, user and database; an SSL-capable client may first ask whether the server supports encryption. The server then applies host-based authentication rules, negotiates the chosen method, establishes session parameters and only afterwards accepts SQL. Each transition produces different evidence and requires a different correction.PostgreSQL 通常在 TCP port 5432 接受客户端流量，但套接字成功并不等于数据库会话已经建立。客户端会发送包含协议选项、用户和数据库的启动请求；支持 SSL 的客户端可能先询问服务器是否支持加密。服务器随后应用基于主机的认证规则、协商所选认证方法、建立会话参数，最后才接受 SQL。每个阶段都会产生不同证据，也需要不同的修复方式。
Keep endpoint role in the diagnosis. A load balancer, read replica, PgBouncer instance or cloud proxy can listen on 5432 while presenting behavior different from the primary database. Record the resolved address, endpoint role, server version returned after login and whether the application needs read-write or read-only semantics. A port test against a replica cannot validate that the application can commit a transaction on the writer.诊断时必须保留端点角色信息。负载均衡器、只读副本、PgBouncer 或云代理都可能监听 5432，但其行为与主数据库不同。应记录解析地址、端点角色、登录后返回的服务器版本，以及应用需要读写还是只读语义。针对副本的端口测试无法证明应用可以在主库提交事务。
| Stage阶段 | PostgreSQL-specific evidencePostgreSQL 特有证据 | Typical failure典型故障 |
|---|---|---|
| Listener监听器 |
Effective listen_addresses, port and
server process.实际生效的
listen_addresses、端口和服务器进程。
|
Refusal when PostgreSQL is not listening on the requested interface.PostgreSQL 未在目标接口监听时立即拒绝。 |
| TLS requestTLS 请求 |
Client sslmode, certificate identity and
trust root.客户端 sslmode、证书身份和信任根。
|
Encryption required, unsupported or identity verification failed.必须加密、不支持加密或身份校验失败。 |
| HBA decisionHBA 决策 |
First matching pg_hba.conf rule for
connection type, address, database and user.针对连接类型、地址、数据库和用户的第一条匹配
pg_hba.conf 规则。
|
No matching entry or an unexpected authentication method.没有匹配规则或使用了非预期认证方式。 |
| Session capacity会话容量 | Available connection slots, reserved slots and pool behavior.可用连接槽、保留槽和连接池行为。 | Remaining slots reserved or too many clients.剩余槽位被保留或客户端数量过多。 |
Read pg_hba.conf as an ordered decision table把 pg_hba.conf 视为有顺序的决策表
pg_hba.conf is evaluated from top to bottom, and
the first matching record determines the authentication method.
PostgreSQL does not fall through to a later rule when
authentication under that record fails. A broad earlier network
range can therefore shadow a more specific later rule, while a
connection using TLS may match a hostssl entry that
a non-TLS diagnostic does not. Compare the full tuple:
connection type, client address, database, user and
authentication method.pg_hba.conf
按从上到下的顺序评估，第一条匹配记录决定认证方法。如果在该记录下认证失败，PostgreSQL
不会继续尝试后面的规则。因此，前面较宽泛的网段可能遮蔽后面更具体的规则；使用
TLS 的连接也可能匹配 hostssl，而非 TLS
诊断不会。比较时必须包含完整条件：连接类型、客户端地址、数据库、用户和认证方法。
Do not infer the client address from its local interface. Kubernetes egress, NAT gateways and database proxies can change the source observed by PostgreSQL. Correlate the server log with the failed attempt, then identify the exact matching rule in the file currently loaded by the server. After an approved edit, reload configuration and verify the new rule from the original failing runtime. Keep the narrowest address range and database/user scope that satisfies the workload.不要从客户端本地接口推断 PostgreSQL 看到的地址。Kubernetes 出口、NAT 网关和数据库代理都可能改变服务器观察到的来源。应把服务器日志与失败尝试关联，然后在服务器当前加载的文件中定位准确匹配规则。获准修改后重新加载配置，并从原始失败运行时验证新规则。地址范围以及数据库/用户范围都应尽可能收窄。
Common diagnostic trap: adding a permissive
rule at the end does nothing when an earlier record already
matches. Prove rule order before broadening access, and never
replace host authentication with trust merely to
make a test pass.常见诊断陷阱：如果前面已有记录匹配，在文件末尾增加宽松规则不会生效。扩大访问前先证明规则顺序，也不要仅为了让测试通过就把主机认证改为
trust。
Choose PostgreSQL sslmode deliberately明确选择 PostgreSQL sslmode
PostgreSQL clients expose several SSL modes whose names represent materially different guarantees. A mode that merely prefers encryption can still connect without it when the server declines SSL, while identity-verifying modes require a trusted chain and a server certificate valid for the requested hostname. Record the effective client mode instead of assuming that “SSL enabled” means the same thing across drivers. Managed services may also require a provider CA bundle that is absent from the operating system’s default trust store.PostgreSQL 客户端提供多种 SSL 模式，而这些模式代表完全不同的安全保证。仅“优先”加密的模式在服务器拒绝 SSL 时仍可能以非加密方式连接；验证身份的模式则要求可信证书链，并且服务器证书必须适用于请求的主机名。应记录实际生效的客户端模式，不要假设不同驱动中的“已启用 SSL”含义相同。托管服务还可能要求操作系统默认信任库中不存在的供应商 CA 包。
Test certificate rotation before expiry with the same container image and trust material production uses. A laptop may trust a CA that a minimal container does not. Verify both fresh connections and pooled reconnection because existing encrypted sessions can survive while all new handshakes fail. If a temporary diagnostic test relaxes verification, label it as a controlled experiment, never as the final fix, and immediately restore the approved mode.证书到期前，应使用与生产相同的容器镜像和信任材料测试轮换。开发者电脑可能信任某个 CA，而精简容器并不信任。既要测试新连接，也要测试连接池重连，因为已有加密会话可能仍然存活，而所有新握手都已失败。如果临时诊断需要放宽校验，应把它标记为受控实验，而不是最终修复，并立即恢复获准模式。
Separate port 5432 availability from session capacity区分 port 5432 可达与会话容量
A PostgreSQL listener can remain reachable while the database
has no general connection slots available. Server limits,
reserved administrator capacity, per-role limits and pooler
limits interact. Increasing max_connections is not
automatically safe because each backend consumes memory and
coordination overhead. First inspect how many application
instances exist, their minimum and maximum pool sizes,
connection lifetime, leak detection and burst behavior.即使 PostgreSQL
监听器仍然可达，数据库也可能没有普通连接槽可用。服务器上限、管理员保留容量、角色级限制以及池化器上限会相互作用。直接提高
max_connections
并不一定安全，因为每个后端进程都会消耗内存和协调开销。应先检查应用实例数量、连接池最小值和最大值、连接生命周期、泄漏检测以及突发行为。
When PgBouncer or another proxy sits in front of 5432, distinguish client connections from server connections and transaction pooling from session pooling. Session-dependent features such as temporary tables, session settings or advisory locks may behave differently under transaction pooling. Capacity testing must therefore exercise the application’s actual transaction pattern, not only repeated login/logout. Track pool acquisition time, active server backends, waiting sessions, rejected clients and recovery after database restart.当 PgBouncer 或其他代理位于 5432 前面时，要区分客户端连接与服务器连接，也要区分事务池化和会话池化。在事务池化下，临时表、会话设置或咨询锁等依赖会话的功能可能表现不同。因此，容量测试必须执行应用真实事务模式，而不只是反复登录退出。应监控连接池获取时间、活动服务器后端、等待会话、被拒客户端以及数据库重启后的恢复情况。
- Measure demand测量需求Count application instances and calculate their possible aggregate pool demand.统计应用实例并计算可能的连接池总需求。
- Preserve headroom保留余量Reserve capacity for operations, failover and controlled traffic spikes.为运维、故障切换和受控流量峰值保留容量。
- Exercise recovery验证恢复Restart or fail over in a safe environment and confirm retries do not create a reconnect storm.在安全环境中重启或切换，并确认重试不会制造重连风暴。
Create a PostgreSQL connection acceptance record建立 PostgreSQL 连接验收记录
A defensible acceptance check identifies the server and session, not merely the open port. From the application runtime, capture the resolved endpoint, connected server address, PostgreSQL version, current database, current user, transaction read-only state and TLS status using approved read-only inspection. Follow with one bounded parameterized query that represents the application’s expected data path. Redact object names when necessary and never copy business rows into the ticket.可靠的验收检查应识别服务器与会话，而不只是开放端口。从应用运行时获取解析端点、已连接服务器地址、PostgreSQL 版本、当前数据库、当前用户、事务只读状态和 TLS 状态，并使用获准的只读检查。随后执行一条代表应用预期数据路径的有界参数化查询。必要时对对象名脱敏，也不要把业务数据行复制到工单中。
Test both a fresh connection and the application’s normal pool path, then repeat during a controlled role change or restart in a non-production environment. Record pool acquisition latency, authentication result, first-query latency and recovery time. If the endpoint can select multiple replicas or availability-zone addresses, retain the address used for each attempt. The final record should distinguish what was observed from what is inferred and list exclusions such as write traffic, long transactions, logical replication or maximum concurrency.既要测试新连接，也要测试应用正常连接池路径，并在非生产环境中受控角色切换或重启时重复。记录连接池获取延迟、认证结果、首条查询延迟和恢复时间。如果端点可能选择多个副本或可用区地址，应保留每次尝试使用的地址。最终记录应区分观察事实与推断，并列出写流量、长事务、逻辑复制或最大并发等未覆盖范围。
Include the active pg_hba.conf rule and client SSL
mode in the sanitized record, because a later rule reorder or
driver-default change can recreate the failure even when host
and port stay constant. Name the configuration owner who will
review those dependencies after upgrades and scheduled
security-policy changes.脱敏记录中还应包含实际命中的
pg_hba.conf 规则和客户端 SSL
模式，因为即使主机和端口不变，后续规则重排或驱动默认值变化仍可能重新触发故障。还应指定在升级及计划安全策略变更后负责复核这些依赖的配置负责人。
A repeatable port 5432 diagnostic workflow可重复的 port 5432 诊断流程
Move from observed runtime context to the first failing stage, then validate the smallest safe correction.从实际运行上下文定位首个失败阶段，再验证最小安全修正。
- Capture the exact context捕获准确上下文Record time, runtime identity, source network, driver/version, sanitized configuration, endpoint, database and error.记录时间、运行身份、来源网络、驱动/版本、脱敏配置、端点、数据库和错误。
- Resolve the effective destination解析实际目标Verify DNS answers, route, proxy and the exact 5432 used by the process.验证 DNS 答案、路由、代理以及进程实际使用的 5432。
- Test transport and TLS测试传输与 TLSMeasure socket and handshake stages separately; verify trust chain and server identity.分别测量套接字与握手阶段，验证信任链和服务器身份。
- Test identity and target scope测试身份与目标范围Validate pg_hba.conf rule order, database/user matching and authentication method, database or service selection and effective permissions.验证 pg_hba.conf rule order, database/user matching and authentication method、数据库或服务选择以及有效权限。
- Run a minimal safe operation运行最小安全操作Use a deterministic, bounded, read-only operation before representative workload testing.先运行确定性、有界、只读操作，再进行代表性工作负载测试。
- Correct, retest and monitor修正、重测与监控Change one controlled variable, preserve rollback, retest from the failing context and watch recurrence.一次只改变一个受控变量，保留回滚，从失败上下文重测并观察复发。
Prepare port 5432 evidence for compatibility review为兼容性审查准备 port 5432 证据
Prepare sanitized engine and version, client runtime, driver and version, source environment, endpoint, 5432, database or service, TLS mode, authentication method, effective non-secret properties, exact error, first failing stage and recent changes. Never include passwords, tokens, private keys or unredacted production strings.准备脱敏后的引擎与版本、客户端运行时、驱动与版本、来源环境、端点、5432、数据库或服务、TLS 模式、认证方法、有效非密钥属性、准确错误、首个失败阶段和近期变更。不要包含密码、令牌、私钥或未脱敏生产字符串。
Review port 5432 compatibility审查 port 5432 兼容性
Use the InfiniSynapse DB Compatibility Checker to review the PostgreSQL version, client or driver, endpoint type, port and TLS expectations from sanitized inputs. Then verify the live path with the real database name, role class and sslmode: the checker cannot evaluate pg_hba.conf rule order, CONNECT privilege or a pooler's routing state.可使用 InfiniSynapse DB Compatibility Checker 根据脱敏输入检查 PostgreSQL 版本、客户端或驱动、端点类型、端口和 TLS 要求。随后必须使用真实数据库名称、角色类型和 sslmode 验证在线路径，因为该工具无法判断 pg_hba.conf 规则顺序、CONNECT 权限或连接池代理路由状态。
Open DB Compatibility Checker打开 DB Compatibility Checkerport 5432 FAQport 5432 常见问题
What uses port 5432?什么服务使用 5432 端口？
Port 5432 is PostgreSQL's conventional default TCP port. A deployment may use another port or place PgBouncer, a managed proxy or another pooler on 5432, so a response identifies an endpoint but not necessarily the backend server process.5432 是 PostgreSQL 约定的默认 TCP 端口。部署可以改用其他端口，也可能让 PgBouncer、托管代理或其他连接池代理监听 5432，因此端口有响应只能识别端点，未必就是后端数据库进程。
How do I test PostgreSQL on port 5432?如何测试 5432 端口上的 PostgreSQL？
Use pg_isready from the failing network to distinguish accepting, rejecting and no-response states, then test with psql or the application using the exact database, role and sslmode and run a minimal SELECT 1. pg_isready does not require correct credentials, so readiness is not proof of login.从失败网络使用 pg_isready 区分 accepting、rejecting 与 no response 状态，再用 psql 或应用按准确数据库、角色和 sslmode 连接，并执行最小 SELECT 1。pg_isready 不要求正确凭据，因此就绪不等于登录成功。
Why is port 5432 reachable but PostgreSQL login fails?为什么 5432 可达但 PostgreSQL 登录失败？
PostgreSQL may select a pg_hba.conf record that rejects the client address, database, role or encryption type; the role password or CONNECT privilege may fail; or the requested database may not exist. Use the exact server message and SQLSTATE because the first matching HBA record controls authentication.PostgreSQL 可能匹配到拒绝客户端地址、数据库、角色或加密类型的 pg_hba.conf 记录；角色密码或 CONNECT 权限也可能失败，目标数据库还可能不存在。应依据准确服务端消息和 SQLSTATE，因为首条匹配的 HBA 记录决定认证方式。
Should PostgreSQL port 5432 be publicly reachable?PostgreSQL 5432 端口应该允许公网访问吗？
Normally no. Keep listen_addresses, network controls and pg_hba.conf scoped to approved private clients, preferably with hostssl rules and verified TLS. If an external use case is approved, place it behind a controlled access layer and avoid broad 0.0.0.0/0 or ::0/0 authorization.通常不应。应让 listen_addresses、网络控制和 pg_hba.conf 只覆盖获准私有客户端，优先采用 hostssl 规则和经过验证的 TLS。若外部场景获准，应置于受控访问层之后，并避免使用宽泛的 0.0.0.0/0 或 ::0/0 授权。
What PostgreSQL evidence can I share safely?哪些 PostgreSQL 证据可以安全分享？
Share PostgreSQL and client-library versions, anonymized endpoint type, port, database and role classes, sslmode, pg_isready result, SQLSTATE and a redacted matching pg_hba.conf rule with the address narrowed or masked. Do not share passwords, .pgpass contents, URI secrets, tokens or private keys.可以分享 PostgreSQL 与客户端库版本、匿名化端点类型、端口、数据库与角色类别、sslmode、pg_isready 结果、SQLSTATE，以及已缩小或遮盖地址的匹配 pg_hba.conf 规则。不要分享密码、.pgpass 内容、URI 密钥、令牌或私钥。
How do I move PostgreSQL to a new port or endpoint safely?如何安全迁移 PostgreSQL 端口或端点？
Prepare the new endpoint together with pooler, replica, health-check, DNS, firewall and pg_hba.conf changes. Test representative clients, canary traffic, watch connection errors and pool saturation, retain the old endpoint for rollback, and update scheduled jobs and PGPORT settings before draining it.应同时准备新端点及连接池代理、副本、健康检查、DNS、防火墙和 pg_hba.conf 变更。测试代表性客户端并灰度流量，监控连接错误与连接池饱和度，保留旧端点用于回滚，并在排空前更新计划任务和 PGPORT 设置。