07 Firebird servers on Linux

This chapter describes two Linux setups that the TCP/IP mode works with:

Firebird 5.0 in a Docker container, set up with Docker Compose
an existing Firebird 2.5 installed directly on a Linux server

Most installations run Firebird 2.5 on Windows. For those, this chapter does not apply.

Firebird 5.0 with Docker Compose

The setup uses the official image firebirdsql/firebird. It publishes Firebird on port 3055, the same port the GTR Firebird setup uses on Windows.

Files

Create a folder for the stack, for example /opt/firebird50, with this content:

/opt/firebird50/compose.yaml
/opt/firebird50/.env
/opt/firebird50/data/

compose.yaml:

services:
  firebird:
    image: firebirdsql/firebird:5.0.4
    container_name: firebird50
    restart: unless-stopped
    ports:
      - "3055:3050"
    environment:
      FIREBIRD_ROOT_PASSWORD: ${FIREBIRD_ROOT_PASSWORD:?set in .env}
      FIREBIRD_USE_LEGACY_AUTH: "true"
      FIREBIRD_CONF_DatabaseAccess: "Restrict /var/lib/firebird/data"
      TZ: Europe/Berlin
    volumes:
      - ./data:/var/lib/firebird/data

.env holds the SYSDBA password:

FIREBIRD_ROOT_PASSWORD=<password>

Setup

Run these commands as root on the Docker host:

mkdir -p /opt/firebird50/data
cd /opt/firebird50
# create compose.yaml and .env as shown above
chmod 600 .env
docker compose up -d
docker compose logs firebird

chmod 600 limits .env to root, because it contains the password. To create a random password, run tr -dc A-Za-z0-9 </dev/urandom | head -c 20; echo.

Settings

Setting	Effect
`image: firebirdsql/firebird:5.0.4`	Fixes the Firebird version. Change the tag to update Firebird.
`ports: "3055:3050"`	Firebird listens on port 3050 inside the container. The host publishes it as port 3055.
`FIREBIRD_ROOT_PASSWORD`	Password of the user SYSDBA. The container sets it at every start.
`FIREBIRD_USE_LEGACY_AUTH`	Turns on Legacy_Auth. See Legacy_Auth.
`FIREBIRD_CONF_DatabaseAccess`	Writes `DatabaseAccess` to `firebird.conf`. The server opens and creates databases only in `/var/lib/firebird/data`.
`TZ`	Time zone of the container
`volumes: ./data:/var/lib/firebird/data`	The databases live in `/opt/firebird50/data` on the host. They stay when the container is replaced.

Legacy_Auth

Firebird Management logs in with Legacy_Auth. A Firebird 5.0 server accepts this login only if Legacy_Auth is turned on and the user exists in Legacy_UserManager.

With FIREBIRD_USE_LEGACY_AUTH: "true" the image:

sets AuthServer and AuthClient to Legacy_Auth, Srp256, Srp
sets UserManager to Legacy_UserManager, Srp
sets WireCrypt to Enabled, so clients without encryption can connect
creates SYSDBA with the password from .env in both user managers

Legacy_Auth uses only the first 8 characters of a password. A longer password works, but the characters after the eighth have no effect for Legacy_Auth logins.

To change the password, edit .env and run docker compose up -d in /opt/firebird50. The container starts again and sets the new password.

Port and firewall

Clients connect to port 3055 of the Docker host. Every firewall between the client and the Docker host must allow TCP port 3055.

Docker publishes the port with its own packet filter rules. These rules take effect before the rules of ufw, so a ufw rule does not block port 3055. To limit access, use one of these methods:

Publish the port on one address of the host, for example "192.168.1.10:3055:3050".
Add rules to the DOCKER-USER chain. The Docker documentation describes this under “Packet filtering and firewalls”.

Paths

Firebird sees the database folder as /var/lib/firebird/data. Enter this path in Firebird Management and in ProfDia, for example /var/lib/firebird/data/PROFDIA.FDB. The host path /opt/firebird50/data/PROFDIA.FDB does not work, because the server runs inside the container.

The image runs Firebird as root inside the container. The owner and mode of files in data/ do not block the server.

Connection settings

Program	Field	Value
Firebird Management, box Firebird 5 target	Server	name or address of the Docker host, for example `docker-firebird50.gtr.net`
	Port	`3055`
	Database path on the server	`/var/lib/firebird/data/<name>.FDB`
	User, Password	`SYSDBA` and the password from `/opt/firebird50/.env`
ProfDia (`NCPro_db.ini`)	`Server`, `Port`, `Database`	the same values

A Firebird 2.5 database reaches the container through Migrate from Firebird 2.5 to 5.x in the TCP/IP mode. Do not copy a Firebird 2.5 database file into data/. Firebird 5.0 cannot open it.

Operation

Show the log: docker compose logs firebird
Update Firebird: change the image tag in compose.yaml, then run docker compose pull and docker compose up -d
Copy database files from data/ only while the container is stopped (docker compose stop). An open database file can be inconsistent in a copy.

Firebird 2.5 installed directly on Linux

The service of a directly installed Firebird 2.5 runs as the user firebird. This user needs write access to each database file and to its folder:

Database file: Firebird opens a database for reading and writing, also for a backup. Without write access, the backup fails. See Server cannot open the database for writing.
Folder: a vacuum restores the database as a new file in the same folder. Without write access to the folder, the operation stops before the backup. See Server cannot create a database in the folder.

Keep the databases in a folder that belongs to firebird, not directly in a system folder such as /opt:

mkdir -p /opt/firebird-data
chown firebird:firebird /opt/firebird-data
chmod 770 /opt/firebird-data

A file that root copies into this folder belongs to root. Give it to firebird:

chown firebird:firebird /opt/firebird-data/PROFDIA.FDB
chmod 660 /opt/firebird-data/PROFDIA.FDB

Mode 660 gives read and write access to the user and the group firebird only. Do not use chmod 777. It lets every user on the server read and change the database.

Files that the Firebird service creates, for example by a restore, belong to firebird already.

An alias of the database points to the old path after you move the file. Update the path in aliases.conf of the Firebird installation, for example /opt/firebird/aliases.conf.

These steps apply to Firebird installed directly on Linux. For a server in a Docker container, see Firebird 5.0 with Docker Compose.

GTR FAQ

Explorer