FATAL: No pg_hba.conf entry for host errors

The dreaded "FATAL: no pg_hba.conf entry for host" error is one of the most common and frustrating errors in all Postgresdom. The confusion stems from the fact that this is a poorly worded error message: in most cases, the problem is not the lack of an entry for a host in pg_hba.conf. The problem is that the client is attempting to connect in a way the server does not support.

All Database Labs Postgreses require SSL for all connections. SSL is not on by default in some Postgres client libraries. Usually, this error happens when a client is attempting to connect without SSL enabled. In this case, enabling SSL on the client and reconnecting solves the problem.

Read on for a full explanation of what's going on, and why Postgres generates this misleading error message.

pg_hba.conf tells Postgres under what conditions it should permit connections to the database. Each line in that file specifies a set of conditions which must be satisfied in order to connect. Connections can be limited to certain IP addresses, to SSL or non-SSL, or they can only permit certain authentication methods.

If a client attempts to connect to the database in such a way that no conditions in the file are met, the same generic "FATAL: no pg_hba.conf entry for host" error is generated, no matter what the reason was for the rejection. This message suggests that the solution is to add a line to pg_hba.conf, but the answer is usually to alter settings on the client rather than to modify a server config file.

Database Labs databases by default allow connections from anywhere on the Internet, require SSL on all connections, and use password authentication.

Most client libraries use passwords by default, but many do not turn SSL on by default. This is by far the most common cause of "no pg_hba.conf entry for..." errors.

In almost all cases, simply turning SSL on the clientside solves the issue.

If this doesn't do it for you, write to us at support@databaselabs.io and we'll help.

February 17, 2016