PostgreSQL 16 Installation & Configuration Guide

Ubuntu Linux — Open Connection to All Hosts

Prerequisites

• Fresh Ubuntu instance (20.04, 22.04, or 24.04)
• Sudo privileges
• Internet access

Step 1 — Add the PostgreSQL APT Repository

Install dependencies and import the official PostgreSQL signing key:

sudo apt install -y curl ca-certificates
sudo install -d /usr/share/postgresql-common/pgdg
sudo curl -o /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc 
  --fail https://www.postgresql.org/media/keys/ACCC4CF8.asc

Register the repository:

sudo sh -c 'echo "deb [signed-by=/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc] 
  https://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" 
  > /etc/apt/sources.list.d/pgdg.list'

Step 2 — Install PostgreSQL 16

sudo apt update && sudo apt install -y postgresql-16

Step 3 — Start and Enable the Service

sudo systemctl enable --now postgresql

Verify the service is running:

sudo systemctl status postgresql

Step 4 — Configure postgresql.conf — Listen on All Interfaces

Open the configuration file:

sudo nano /etc/postgresql/16/main/postgresql.conf

Locate the listen_addresses directive and change it from localhost to *:

listen_addresses = '*'

Note: This file controls server-level settings. Do not add pg_hba.conf entries here — a common mistake that causes startup errors.

Step 5 — Configure pg_hba.conf — Allow All Remote IPs

Open the host-based authentication file:

sudo nano /etc/postgresql/16/main/pg_hba.conf

Add the following lines at the bottom of the file:

# IPv4 — allow all hosts
host    all    all    0.0.0.0/0    scram-sha-256

# IPv6 — allow all hosts
host    all    all    ::/0         scram-sha-256

Important: pg_hba.conf and postgresql.conf are separate files. Entries from one must never be placed in the other.

Step 6 — Set a Password for the postgres User

sudo -u postgres psql -c "ALTER USER postgres PASSWORD 'yourpassword';"

Replace yourpassword with a strong password. This is required for remote authentication with scram-sha-256.

Step 7 — Restart PostgreSQL

Apply all configuration changes:

sudo systemctl restart postgresql

Step 8 — Open Port 5432 in the Firewall

If ufw is active:

sudo ufw allow 5432/tcp
sudo ufw reload

Step 9 — Verify the Server is Listening

ss -tlnp | grep 5432

Expected output:

LISTEN  0  128  0.0.0.0:5432  0.0.0.0:*  users:(("postgres",…))

The address 0.0.0.0:5432 confirms PostgreSQL is bound to all network interfaces.

Key File Locations

Security Notes

• 0.0.0.0/0 opens PostgreSQL to any IP address. On a public-facing server, restrict this to a specific subnet (e.g. 10.0.0.0/8) and rely on firewall rules or a VPN as an additional gate.
• scram-sha-256 is the recommended authentication method in PostgreSQL 16. Do not downgrade to md5 unless a legacy client explicitly requires it.
• Never expose port 5432 directly to the public internet in production without additional access controls.