When a service's clients live on the same machine, the most reliable way to close it is binding: the service itself listens on 127.0.0.1 only.
The shop application runs on this same server and reaches the database at localhost. So the database needs only the loopback address. PostgreSQL takes its bind address from the listen_addresses parameter (in the Wiki). Its default is 'localhost' — in postgresql.conf this line is commented out. A search through the settings directory finds where it was overridden:
Files from conf.d/ are read after postgresql.conf, and the last value wins. Next to the parameter, postgresql.conf says (change requires restart): the address changes only with a restart. After a reload the database rereads the file, but the sockets stay on 0.0.0.0.
The database already kept the outside machine out: pg_hba.conf refused it the login. But it accepted the connection — so the code that checks passwords is reachable. Binding removes that too.
Sometimes the port is not opened by the program itself. With a .socket unit, systemd holds the port, and ss shows the systemd process on it; the address is set by the socket's ListenStream= line (in the Wiki).
Close the database by binding
Make PostgreSQL accept connections only from the server itself, while the shop application on the server still reaches it. Check from the outside machine: sudo ip netns exec lab-outside nc -zv -w 2 192.0.2.1 5432.
Goals · 0 of 2
- Close the database to the outside machine with its own setting not done yet
- Keep the database reachable on the server itself not done yet