Fix: FATAL: no pg_hba.conf entry for host

The PostgreSQL documentation shows the error in this form:

FATAL:  no pg_hba.conf entry for host "123.123.123.123", user "andym", database "testdb"

Recent server versions append the connection’s encryption state at the end, for example , no encryption or an SSL note. Read every part of the message: it tells you exactly which combination of client address, user, database and encryption found no matching rule.

This is not a password problem. The client reached the server and the server is running, but pg_hba.conf has no line for this connection, so it is refused before any password is asked for.

Causes, most likely first

1. No rule for the client’s network. The default file usually allows only local socket and loopback (127.0.0.1/32, ::1/128) connections. The client’s address is shown in the message; behind NAT, a proxy or Docker it may not be the address you expected.
2. SSL mismatch. A hostssl rule matches only encrypted connections and hostnossl only unencrypted ones. If the message says no encryption and you only have hostssl lines, the client must connect with SSL (for example sslmode=require) or you need a host rule.
3. Database or user does not match. The rule names a different database or role, or uses +group and the user is not a member.
4. Replication connection. Standbys and pg_basebackup need a rule with the special database name replication; all does not match replication connections.
5. You edited a file the server does not read, or did not reload after editing.

Fix it step by step

1. Find the file the server uses: sudo -u postgres psql -c 'SHOW hba_file;'.
2. Add a rule as narrow as possible: the specific database, user and client network, with scram-sha-256.
3. Make sure no earlier line already matches this connection with a different result (for example a reject rule).
4. Check for parse errors, then reload. A restart is not needed.
5. Connect again from the client.

# TYPE  DATABASE        USER            ADDRESS                 METHOD
host    appdb           appuser         10.0.0.0/24             scram-sha-256
hostssl appdb           appuser         192.0.2.0/24            scram-sha-256
host    replication     replicator      10.0.0.12/32            scram-sha-256

SELECT line_number, type, database, user_name, address, auth_method, error
FROM pg_hba_file_rules;

SELECT pg_reload_conf();

pg_hba_file_rules shows the file as currently saved on disk, so you can spot a typo (a non-empty error column) before reloading.

Related checks

• If the client gets Connection refused or a timeout instead, the server is not listening on that address or a firewall blocks port 5432; check listen_addresses in postgresql.conf (restart required) and the firewall.
• Do not “fix” this with host all all 0.0.0.0/0 trust. That allows anyone who can reach the port to log in as any user without a password.
• On managed or containerized PostgreSQL, the rules may be generated by the platform; change them through its configuration rather than by editing the file.

Official documentation

• Authentication problems
• The pg_hba.conf file