When auditing a machine for one of my clients I noticed that they have PostgreSQL listening and accessible from public network. This is not necessary for their application, seems they simply neglected to set up the firewall properly.
PostgreSQL seems to be running default
pg_hba.conf file from the distribution package, and it does not accept connections without valid credentials.
I still feel that it is wrong to unnecessarily expose the database to the outside world. What arguments are for/against such approach?