"Marc G. Fournier" <scrappy@postgresql.org> writes:
> Then again, in the case of pg_upgrade, wouldn't just disabling access from
> anywhere except localhost prevent others from getting in?
Not if your normal operating mode includes connections from clients
running locally. I really don't see any clean way to ensure that
pg_upgrade (and subsidiary pg_dump runs invoked by it) are the only
ones allowed to connect to the database, if we keep the normal
postmaster running. But if we shut down the postmaster then it's
trivial.
regards, tom lane