pg_hba.conf
pg_hba.conf
("hba" stands for "Host-Based Access") is one of PostgreSQL's main configuration files, which is used to determine which users can access which database from which host using which authentication method.
pg_hba.conf
was added in Postgres95.
Location
By default pg_hba.conf
is located in the instance's data directory. This can be overriden by explicitly setting the parameter hba_file
at instance startup.
The location of pg_hba.conf
can be determined by executing one of:
SHOW hba_file;
or
SELECT current_setting('hba_file');
Contents
The system catalogue view pg_hba_file_rules
provides a summary of the current contents of pg_hba.conf
and can be used to check for potential errors before attempting to apply changes.
Change history
Work-in-progress
- PostgreSQL 16
- PostgreSQL 14
- PostgreSQL 10
- logical replication connections now handled as normal connections, i.e. the
replication
keyword is no longer used (commit 8df9bd0b) - contents can be accessed via the view
pg_hba_file_rules
(commit de16ab72)
- logical replication connections now handled as normal connections, i.e. the
- PostgreSQL 8.4
pg_hba.conf
now parsed in postmaster (commit 98723810)- authentication option
clientcert
added (commit 3c486fbd) - some Kerberos options can be set in
pg_hba.conf
, overriding postgresql.conf settings (commit 32c469d7) - former configuration parameters
krb_realm
andkrb_server_hostname
nowpg_hba.conf
options (commit 1b4e729e)
- PostgreSQL 8.0
- configuration parameter
hba_file
added, enablingpg_hba.conf
to be located outside the data directory (initial commit 130f89e9)
- configuration parameter
- PostgreSQL 7.4
- PostgreSQL 7.3
- column
USER
added (commit 43a3543a)
- column
- PostgreSQL 7.2
- authentication method
md5
added (commit bcb0ccf5)
- authentication method
- PostgreSQL 6.4
- support for
sameuser
token added (commit 3f372ee6)
- support for
pg_hba.conf
was added during the Postgres95 development phase (initial commit 57026d60)
References
- PostgreSQL documentation: pg_hba.conf
Useful links
- Make pg_hba.conf Redundant by Using pg_hba.conf - Article by Shaun M. Thomas explaining how to simplify access configuration