kwScheduler - Installation and Database Guide

IP Address Binding

By default, Firebird is bound to 0.0.0.0 IP address. That mean it will be reachable on all available IP addresses. When you are using Firebird only as a backend to your web application you should bind it to local 127.0.0.1 that makes it unavailable from network. You can change the bind address in firebird.conf:

RemoteBindAddress = 127.0.0.1

TCP Port

Firebird server runs on port 3050 by default. You can change it in firebird.conf:

RemoteServicePort = 3050

Use your firewall to limit access to that port. You should not expose it directly to the internet.

Database Paths

When connecting to Firebird, you can specify the database by either:

By default you can open any database that is located on the server and the server process is permitted to read/write by file system. To make your server more secure you can limit the databases that can be open to:

The options in firebird.conf are as follows:

# Unrestricted access (default)
DatabaseAccess = Full

# Access restricted to listed directories
DatabaseAccess = Restrict c:\data1;c:\data2

# Access restricted to database aliases listed in aliases.conf
DatabaseAccess = None

Network Communication

Firebird uses unencrypted network communication. To make it more secure, you can use SSL tunnelling.

	Important
	kwScheduler stores connection information in a kwScheduler.exe.config file in clear text, meaning that user names and passwords are available in "clear" format for anyone browsing those files.

SYSDBA Password and User Management

The administrator account name in Firebird is SYSDBA and the default password is masterkey. (Actually, only first 8 characters of the password are significant.) You should change the SYSDBA password after server installation.

Firebird comes with a command-line user management tool called gsec. Although its functions can also be performed by a number of third-party GUI utilities, you should at least have a basic knowledge of gsec, since this is the official tool and it's present in every Firebird server installation. In the next sections you will use gsec to execute two tasks: changing the SYSDBA password and adding a Firebird user.

One Firebird account is created automatically as part of the installation process: SYSDBA. This account has all the privileges on the server and cannot be deleted. Depending on version, OS, and architecture, the installation program will either

If the password is masterkey and your server is exposed to the Internet at all – or even to a local network, unless you trust every user with the SYSDBA password – you should change it immediately using the gsec command-line utility. Go to a command shell, cd to the Firebird bin subdirectory and issue the following command to change the password to (as an example) icuryy4me:

gsec -user sysdba -pass masterkey -mo sysdba -pw icuryy4me

Notice that you specify “sysdba” twice in the command:

If all has gone well, the new password icuryy4me is now encrypted and stored, and masterkey is no longer valid. Please be aware that unlike Firebird user names, passwords are case-sensitive.

Firebird allows the creation of many different user accounts, each of which can own databases and also have various types of access to databases it doesn't own.

Using gsec, you can add a user account as follows from the command line in the Firebird bin subdirectory:

gsec -user sysdba -pass masterkey -add billyboy -pw sekrit66

Provided that you've supplied the correct password for SYSDBA, a user account called billyboy will now have been created with password sekrit66. Remember that passwords are case-sensitive.

	Note
	Passwords are case sensitive.

Security Database

Firebird maintains a security database storing user names and encrypted passwords. It is located in the root directory of the server installation and controls access to the server itself and all databases in its physical domain. The SYSDBA account has full, destructive privileges to all databases on the server.

Roles

Firebird provides the capability to define ROLEs at database level. Within a database, only SYSDBA and the database owner have full privileges; otherwise, all privileges must be granted explicitly to individual users and/or roles. It is possible – and recommended – to define a set of permissions for a role and then grant that role to specific users as required (kwScheduler uses the "Scheduler" role).

kwScheduler uses a Role named "Scheduler" for database access rights. You do not need to specify (or grant) the role, it is automatically assigned in the program when the user connects to the database through the kwScheduler program (however, if you are using third-party programs to access data in the database, you might need to specify the role name when connecting to the database if you are signing on as a user other than SYSDBA).

Adding Users

SYSDBA can add and delete users' accounts names and modify the details of an account, including the password. Passwords, once stored, are not human-readable, even by SYSDBA.

See above for an example using the gsec command to add a user.

Physical Database Paths

Physical database paths can be shielded from the client using aliases. Access to database files can be restricted to explicitly specified file system trees only – or even tighter – by setting the appropriate parameters in the configuration file firebird.conf (reference the Firebird documentation).

Database Aliases

Database aliases shield the client from physical database locations. Using aliases, a user can connect to “frodo:zappa” without having to know that the real location is frodo:/var/firebird/music/underground/mothers_of_invention.fdb. Aliases also allow you to relocate databases while the users keep using their existing connection strings.

Aliases are listed in the file aliases.conf, in this format on Windows machines:

poker = E:\Games\Data\PokerBase.fdb
blackjack.fdb = C:\Firebird\Databases\cardgames\blkjk_2.fdb

Giving the alias an .fdb (or any other) extension is fully optional. Of course if you do include it, you must also specify it when you use the alias to connect to the database.

	Note
	You can use aliases to connect to a database, but you must use the fully qualified name for any of the other database utilities (such as backup, restore, etc.). The fully qualified name is the name of the database on the server that the Firebird Database Server is located on.

LICENSE:

The software that accompanies this license (collectively the "Software") is the property of KennWare Solutions or its licensors and is protected by copyright law. While KennWare Solutions continues to own the software, You will have certain rights to use the Software after Your acceptance of this license. This license governs any releases, revisions, or enhancements to the Software that KennWare Solutions may furnish to You. Except as may be modified by a KennWare Solutions license certificate, license coupon, or license key (each a "License Module") that accompanies, precedes, or follows this license, Your rights and obligations with respect to the use of this Software are as follows:

YOU MAY:

YOU MAY NOT:

LIMITED WARRANTY:

KennWare Solutions warrants that the media on which the Software is distributed will be free from defects for a period of sixty (60) days from the date of delivery of the Software to You. Your sole remedy in the event of a breach of this warranty will be that KennWare Solutions will, at its option, replace any defective media returned to KennWare Solutions within the warranty period or refund the money You paid for the Software. KennWare Solutions does not warrant that the Software will meet Your requirements or that operation of the Software will be uninterrupted or that the Software will be error-free.

The above warranty is exclusive and in lieu of all other warranties; whether express or implied, including the implied warranties of merchantability, fitness for a particular purpose and noninfringement of intellectual property rights. This warranty gives you specific legal rights, you may have other rights, which vary from state to state and country to country.

DISCLAIMER OF DAMAGES:

Some states and countries, including member countries of the European Economic Area, do not allow the limitation or exclusion of liability for incidental or consequential damages, so the below limitation may not apply to You.

To the maximum extent permitted by applicable law and regardless of whether any remedy set forth herein fails of its essential purpose, in no event will KennWare Solutions or its licensors be liable to you for any special, consequential, indirect or similar damages, including any lost profits or lost data arising out of the use or inability to use the Software even if KennWare Solutions has been advised of the possibility of such damages.

In no case shall KennWare Solutions or its licensor's liability exceed the purchase price for the Software. The disclaimers and limitations set forth above apply regardless of whether You accept the Software.

U.S. GOVERNMENT RESTRICTED RIGHTS:

Restricted rights legend. All KennWare Solutions products and documentation are commercial in nature. The Software and Software documentation are "Commercial Items", as that term is defined in 48 C.F.R. section 2.101, consisting of "Commercial Computer Software" and "Commercial Computer Software Documentation", as such terms are defined in 48 C.F.R. section 252.227-7014(a)(1), and used in 48 C.F.R. section 12.212 and 48 section C.F.R. section 227.7202, as applicable. Consistent with 48 C.F.R. section 12.212, 48 C.F.R. section 252.227-7015, 48 C.F.R. section 227.7202 through 227.7202-4, 48 C.F.R. section 52.227-14, and other relevant sections of the Code of Federal Regulations, as applicable, KennWare Solutions computer software and computer software documentation are licensed to United States Government end users with only those rights as granted to all other end users, according to the terms and conditions contained in this license agreement. Manufacturer is KennWare Solutions, 7100 Bellaire Ave., Des Moines, IA 50311.

EXPORT REGULATION:

Export and re-export of this Software is governed by the laws and regulations of the United States and import laws and regulations of certain other countries. Export or re-export of Software to any entity on the Denied Parties List and other lists promulgated by various agencies of the United States Federal Government is strictly prohibited.

GENERAL:

If you are located in North America or Latin America, this Agreement will be governed by the laws of the State of Iowa, United States of America. Otherwise, this Agreement will be governed by the laws of England. This Agreement and any related License Module is the entire agreement between You and KennWare Solutions relating to the Software and: (i) supercedes all prior or contemporaneous oral or written communications, proposals and representations with respect to its subject matter; and (ii) prevails over any conflicting or additional terms of any quote, order, acknowledgement or similar communications between the parties. This Agreement shall terminate upon Your breach of any term contained herein and You shall cease use of and destroy all copies of the Software. The disclaimers of warranties and damages and limitations on liability shall survive termination. This Agreement may only be modified by a License Module which accompanies this license or by a written document that has been signed by both You and KennWare Solutions. Should you have any questions concerning this Agreement, or if you desire to contact KennWare Solutions for any reason, please write: KennWare Solutions Customer Service, 7100 Bellaire Ave., Des Moines, IA 50311, U.S.A.