PostgreSQL Port 5433 Connectivity Checker

Threat/Impact Level: HIGH | Exploitability/Downtime Risk: HIGH | Time to Fix: 5–15 mins

TL;DR

• What broke: PostgreSQL was told to listen on port 5433 in postgresql.conf, but one or more of the following still points to the old port: the client connection string, pg_hba.conf, the OS firewall, or the service socket — so the TCP handshake never completes.
• How to fix it: Confirm the server is actually bound to 5433 with ss -tlnp | grep 5433, then cascade the port change through every layer: postgresql.conf → firewall rules → pg_hba.conf → client DSN → service restart.
• Shortcut: Use our Client-Side Sandbox above to paste your postgresql.conf and connection string — it will auto-refactor both and generate the corrected psql command without sending your credentials anywhere.

psql: error: could not connect to server: Connection refused
        Is the server running on host "127.0.0.1" and accepting
        TCP/IP connections on port 5433?

How to Fix It

Step 1 — Verify What Port PostgreSQL Is Actually Bound To

# Is Postgres even running on 5433?
ss -tlnp | grep postgres

# Expected output if config was applied correctly:
# LISTEN 0 128 0.0.0.0:5433 0.0.0.0:* users:(("postgres",pid=1234,fd=5))

# If you see 5432 here, the config change was NOT applied.

Step 2 — Fix `postgresql.conf` (Basic Fix)

# /etc/postgresql/15/main/postgresql.conf

- port = 5432
+ port = 5433

Then restart the service — a reload is NOT sufficient for a port change:

sudo systemctl restart postgresql
# Verify:
sudo systemctl status postgresql
ss -tlnp | grep 5433

Step 3 — Update the Firewall

# UFW (Ubuntu/Debian)
- sudo ufw allow 5432/tcp
+ sudo ufw allow 5433/tcp
+ sudo ufw deny 5432/tcp   # Close the old port. Do not leave it open.
+ sudo ufw reload

# iptables (RHEL/CentOS/raw)
- iptables -A INPUT -p tcp --dport 5432 -j ACCEPT
+ iptables -A INPUT -p tcp --dport 5433 -j ACCEPT
+ iptables -D INPUT -p tcp --dport 5432 -j ACCEPT

AWS / GCP / Azure: Update your Security Group inbound rule or VPC Firewall Rule. Remove the 5432 rule. Add 5433 scoped to your application subnet CIDR — never 0.0.0.0/0.

Step 4 — Update `pg_hba.conf` (Enterprise Best Practice)

pg_hba.conf itself doesn't contain port numbers, but if you're using peer authentication or Unix domain sockets, the socket path changes. Verify:

# /etc/postgresql/15/main/pg_hba.conf
# No port change needed here, but confirm the socket dir matches:

# postgresql.conf:
- unix_socket_directories = '/var/run/postgresql'
+ unix_socket_directories = '/var/run/postgresql'  # Unchanged — correct.

# The .s.PGSQL.5433 socket file must exist after restart:
# ls /var/run/postgresql/.s.PGSQL.5433

Step 5 — Fix the Client Connection String

# Application .env / secrets manager / DSN

- DATABASE_URL=postgresql://appuser:secret@db.internal:5432/mydb
+ DATABASE_URL=postgresql://appuser:secret@db.internal:5433/mydb

# psql CLI
- psql -h 127.0.0.1 -p 5432 -U appuser mydb
+ psql -h 127.0.0.1 -p 5433 -U appuser mydb

# PgBouncer pgbouncer.ini
- host=127.0.0.1 port=5432
+ host=127.0.0.1 port=5433

Step 6 — Full Verification Sequence

# 1. Confirm port binding
ss -tlnp | grep 5433

# 2. Test TCP reachability (before even involving psql)
nc -zv 127.0.0.1 5433
# Expected: Connection to 127.0.0.1 5433 port [tcp/*] succeeded!

# 3. Test auth
psql -h 127.0.0.1 -p 5433 -U appuser -d mydb -c 'SELECT version();'

# 4. Confirm OLD port is dead
nc -zv 127.0.0.1 5432
# Expected: nc: connect to 127.0.0.1 port 5432 (tcp) failed: Connection refused

💡 Tired of pasting proprietary infrastructure configs into public LLMs? Generic AI interfaces log your company's ARNs, connection strings, and private keys. StackEngine enforces client-side zero-trust boundaries—the sandbox above executes 100% locally in your browser. Drop your broken manifest above to redact secrets locally and synthesize deterministic patch drafts with your own API key.

(For CI/CD pipeline automation, install via npm i -g stackengine).

# .checkov.yaml
checks:
  - CKV_POSTGRES_PORT_NONDEFAULT  # Custom check: flag if port == 5432 in prod

# variables.tf
- variable "db_port" { default = 5432 }
+ variable "db_port" {
+   default     = 5433
+   description = "PostgreSQL non-default port. Must match postgresql.conf and SG rules."
+   validation {
+     condition     = var.db_port != 5432
+     error_message = "Do not use the default PostgreSQL port 5432 in production."
+   }
+ }

# aws_security_group.tf — reference the variable, never hardcode
- from_port = 5432
- to_port   = 5432
+ from_port = var.db_port
+ to_port   = var.db_port

# policy/postgres_port.rego
package postgres

deny[msg] {
  input.postgresql_conf.port != input.app_config.db_port
  msg := sprintf(
    "Port mismatch: postgresql.conf says %v but app DSN uses %v. Deployment blocked.",
    [input.postgresql_conf.port, input.app_config.db_port]
  )
}

# .github/workflows/db-healthcheck.yml
- name: Verify PostgreSQL port binding
  run: |
    nc -zv ${{ secrets.DB_HOST }} ${{ secrets.DB_PORT }} || \
    (echo "FATAL: PostgreSQL not reachable on ${{ secrets.DB_PORT }}" && exit 1)