FAQ--Security scan flags Firebird 'sysdba' password

Question: After installing or upgrading RPM, a security scanner reports that the Firebird service is accessible using the default password. Can the default password be changed?

Answer: Yes. As of RPM 6.2.0.590 (released 2025-06-18) the RPM user interface includes a form for changing the SYSDBA password, and RPM’s database maintenance routines — including the fixdb.bat and shrinkdb.bat scripts — use the password you set. Changing it is the direct answer to the scanner’s finding, and it is the option we recommend.

The two network options below remain useful, and pair well with a password change, but note what they do and do not accomplish: they stop remote connections to Firebird without changing the password. If your scanner runs on the same computer as RPM, it will keep reporting the default password no matter which of them you apply.

Option 1 (recommended): change the SYSDBA password in the RPM UI

Open the RPM user interface and use the SYSDBA password form to set a new password. RPM stores it and uses it for its own database work from that point on, so the maintenance routines and the batch scripts continue to function.

Two things to know before you do it:

Under Firebird 2.5 the password is effectively limited to 8 characters. A longer password is accepted, but only the first 8 characters are significant. RPM 7.0 moves to Firebird 5.0, which does not have this limit.
Record the password somewhere your successor will find it. RPM knows it; a future administrator working outside RPM — with Firebird’s own tools, for example — will need it.

If you are running a version earlier than 6.2.0.590, upgrade if you can. The manual procedure below still works, but on those versions the caveats about maintenance really do apply, which is why this page used to describe changing the password as a last resort.

Option 2: bind Firebird to the local address

The least intrusive way to prevent your security scanner from reaching Firebird from another machine is to configure it to listen on the local address only. This allows RPM to use Firebird while not allowing any outside connections. Open the firebird.conf file and locate the line beginning with #RemoteBindAddress =. Clear the comment character (#) at the beginning of the line and add 127.0.0.1 at the end, so it looks like the following, then restart the Firebird service.

RemoteBindAddress = 127.0.0.1

Option 3: remove the Firebird firewall exception

Another way to secure Firebird against remote access is to remove the Firebird SQL Server firewall exception created during installation. To do so, follow these steps.

Open Control Panel. Search for Firewall and click Windows Firewall. Alternatively, click System and Security, then Windows Firewall.
In the left menu, click Allow an app or feature through Windows Firewall.
If User Account Control is in effect, click Change Settings.
Locate and highlight Firebird SQL Server in the list and click the Remove button. Confirm that you want the exception to be removed. You may also temporarily remove the checks from each network type: Domain, Private, and Public. However, doing so may not be possible, in which case you must remove it and then recreate it if necessary.

Note: Options 2 and 3 both block remote access to Firebird. If you use the RPM GUI to administer a remote RPM server, they will prevent that from working.

Changing the password manually

This is the procedure to use on RPM versions earlier than 6.2.0.590, or when you need to work outside the RPM interface.

Open a command prompt by choosing Run from the Windows Start menu, typing cmd.exe, and pressing OK.
Run the following command: "C:\Program Files\Firebird\Firebird_2_5\bin\gsec.exe" -user sysdba -password masterkey -mo sysdba -pw NewPass1
Rerun your security scan and verify the issue is no longer reported.

Notes on that command:

The text following -mo is the username of the account you wish to modify, and the text following -pw is the new password. Substitute your own password.
Firebird may be installed in a different location, so specify the correct path to gsec.exe.
The username is not case-sensitive.
The 8-character limit described in Option 1 applies here too.
On versions before 6.2.0.590 only: the Repair Database option and the fixdb.bat and shrinkdb.bat scripts use the default password, so a manual change will break them until you edit the scripts to match. On 6.2.0.590 and later, use the form in Option 1 and RPM handles this for you.

We document Firebird hardening at greater length in Securing Firebird 2.5.