FAQ--Security scan flags Firebird 'sysdba' password

Question: After installing or upgrading RPM, a security scanner reports that the Firebird service is accessible using the default password. Can the default password be changed?

Answer: Yes. RPM 6.2.0.590 and later (released 2025-06-18) can change the SYSDBA password from the RPM interface, and RPM’s database maintenance, including the fixdb.bat and shrinkdb.bat scripts, uses the password you set. Changing it is the direct answer to the scanner’s finding.

What to do now

1. Update to the current release. RPM 6.2.0.607 is current. Version 6.2.0.590 is the minimum for the password form below.
2. Change the SYSDBA password from the RPM interface, as described in the next section.
3. Restrict Firebird to this computer, unless you manage this RPM server from another computer. See Securing Firebird.
4. Turn off user-defined functions by setting UdfAccess = None. RPM does not use them. See Securing Firebird.
5. Rerun your security scan.

Steps 3 and 4 do not change the password, so on their own they do not clear the scanner’s finding when the scanner runs on the RPM computer. They close Firebird to the network, which is worth doing regardless.

Changing the SYSDBA password in RPM

Run the RPM interface on the RPM computer, as administrator. The command is not offered when the interface is connected to a remote RPM server.

• RPM 6.2: choose File > Firebird Password.
• RPM 7: choose Settings > Security > Change Firebird Password. It is also under File > Database.

RPM stores the new password and uses it for its own database work from then on, so maintenance and the batch scripts keep working.

Two things to know before you change it:

• Under Firebird 2.5, which RPM 6.2 uses, only the first 8 characters count. A longer password is accepted, but anything past the eighth character is ignored. Use all 8, and mix upper and lower case, digits and punctuation. RPM 7 uses Firebird 5.0, which has no such limit, and suggests a longer password for you.
• Record the password where your successor will find it. RPM knows it, but anyone working outside RPM, with Firebird’s own tools for example, will need it.

Blocking network access to Firebird

These two measures stop other computers from reaching Firebird at all. They pair well with a new password, but they do not change it.

Bind Firebird to the local address. Firebird then accepts connections only from the computer it runs on, which is all RPM needs. Securing Firebird has the steps, how to restart the service, and how to confirm the change took effect. In RPM 7 the same setting is under Settings > Security > Remote Firebird Access.

Remove the Firebird firewall exception. The Firebird installer adds a Windows Firewall rule for port 3050. Once Firebird is bound to the local address the rule has no effect, but you can remove it as well:

1. Open Control Panel. Search for Firewall and click Windows Defender Firewall.
2. In the left menu, click Allow an app or feature through Windows Defender Firewall.
3. If User Account Control is in effect, click Change settings.
4. Select Firebird SQL Server in the list and click Remove. Confirm the removal.

Note: Both measures block remote access to Firebird. If you use the RPM interface on another computer to manage this RPM server, they will prevent that from working.

Changing the password manually

Use this procedure on RPM versions earlier than 6.2.0.590, or when you need to work outside the RPM interface.

1. Open a command prompt as administrator.

2. Run the following command, substituting your new password for NewPass1:

   "C:\Program Files\Firebird\Firebird_2_5\bin\gsec.exe" -user sysdba -password masterkey -mo sysdba -pw NewPass1
   

3. Rerun your security scan and verify the issue is no longer reported.

Notes on that command:

• masterkey is Firebird’s default password. If it has already been changed, use the current one instead.
• The text after -mo is the account to change, and the text after -pw is the new password. The 8-character limit above applies here too.
• 32-bit RPM on 64-bit Windows installs Firebird under C:\Program Files (x86)\Firebird\Firebird_2_5\bin. Adjust the path if your Firebird is elsewhere.
• On versions before 6.2.0.590 only: the Repair Database option and the fixdb.bat and shrinkdb.bat scripts use the default password, so a manual change breaks them until you edit the scripts to match. On 6.2.0.590 and later, use the RPM interface instead and RPM handles this for you.

We cover Firebird hardening at greater length in Securing Firebird.