Security :: Securing My Postgresql Database ?

I run Slackware 13.0 and I have an apache server 2.2.13 with a postgresql 8.4.1 database attached to it via php 5.3.0. Both the apache server and the postgresql database are on the same machine.

I have the apache server port 80 exposed to the WAN. It is not a fqdm, it's just a simple IP address. On my index page, a user can login with a user/password that encrypts to md5 via postgresql and takes them into the database.

Here is the vulnerability. Can't a hacker just scan port 80 and find my ip address running apache. Go to my index page, see that I accept user/password for authentication into my postgresql database. Then they could setup a script to simply inject html GET requests of random users and passwords and use those values on the php page(the one where the action link is pointing to in the form tag) that contains user login/password in php to login to my postgresql database. There's nothing stopping that. It would be a simple dictionary attack.

I checked out postgresql documentation and it suggested using ldap, kerberos, or md5 and not trust. I'm using md5 already. I currently use fail2ban for proftpd and sshd and it works great. After 6 failed user/pass attempts on either of these services, the IP gets banned via iptables for 24 hours. I love it. I was wondering if I could use that. Of course postgresql port is not exposed to the WAN which is a good thing. I know that when I put in a wrong user/pass from my index page, I get sent to a default postgresql pg_connect warning page. Perhaps I can increase the verbosity of postgresql's logger, find the phrase that it spits out when there's been a bad login and create a filter using that.

I understand that the way it is currently setup, my server is pretty secure, but where there's a will there's a way. I just feel that my postgresql database is unprotected even tho the postgresql port is not exposed to the WAN. They could just bruteforce from the apache server.