Скачать или смотреть How to Make Firebird Forget the Old SYSDBA Password

Learn how to fix the issue of Firebird retaining the old `SYSDBA` password after changing it. Follow our step-by-step guide for a seamless solution!
---
This video is based on the question https://stackoverflow.com/q/64696654/ asked by the user 'Roman Suska' ( https://stackoverflow.com/u/3872681/ ) and on the answer https://stackoverflow.com/a/64698491/ provided by the user 'Mark Rotteveel' ( https://stackoverflow.com/u/466862/ ) at 'Stack Overflow' website. Thanks to these great users and Stackexchange community for their contributions.

Visit these links for original content and any more details, such as alternate solutions, latest updates/developments on topic, comments, revision history etc. For example, the original title of the Question was: Firebird does not forget default password after changing it for sysdba user

Also, Content (except music) licensed under CC BY-SA https://meta.stackexchange.com/help/l...
The original Question post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license, and the original Answer post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license.

If anything seems off to you, please feel free to write me at vlogize [AT] gmail [DOT] com.
---
How to Make Firebird Forget the Old SYSDBA Password

If you've recently updated the password for the SYSDBA user in Firebird but find that the old password still works, you’re not alone. Many users have encountered this issue, especially after changing the default password from masterkey to a new one. In this guide, we will explore why this happens and how to resolve it effectively.

Understanding the Problem

When you change a password in Firebird using the gsec tool, the system may still allow access using both the old and the newly set passwords. This perplexing behavior stems from how Firebird manages passwords across different authentication plugins.

The Role of Authentication Plugins

Firebird supports multiple authentication plugins — typically Srp and Legacy_Auth. The SYSDBA user exists for both of these plugins, which is why both the old and the new passwords remain valid. To get around this issue and make Firebird "forget" the old password, you can follow a series of steps.

Solutions: How to Change the SYSDBA Password Completely

Step 1: Update the Configuration

First, you need to ensure that both user managers are properly listed in the firebird.conf file. Here's how to do it:

Locate your firebird.conf file, typically found in the installation directory.

Open the file in a text editor.

Find the line starting with UserManager and ensure it contains the following:

[[See Video to Reveal this Text or Code Snippet]]

Save the changes.

Step 2: Restart Firebird

After making the configuration change, you will need to restart your Firebird server. This action allows the new settings to take effect.

Step 3: Change Password for Both Plugins

Now, it's imperative to change the password for both the Srp and Legacy_UserManager plugins. Follow these commands in your SQL console:

Change the password for the Srp plugin:

[[See Video to Reveal this Text or Code Snippet]]

Change the password for the Legacy_UserManager plugin:

[[See Video to Reveal this Text or Code Snippet]]

Important Note: The Legacy_Auth plugin truncates passwords longer than 8 characters, so ensure your new password complies with this limitation.

Optional: Preventing Legacy Authentication

If you wish to entirely eliminate the use of the Legacy_Auth plugin, follow these steps:

Edit the firebird.conf file.

Remove Legacy_Auth from the AuthServer setting.

Check the databases.conf for any custom configurations that might use Legacy_Auth.

Manually Deleting the SYSDBA Account (Advanced)

As a more advanced option, if you'd like to remove the SYSDBA account for Legacy_Auth, you can manually delete it from the security database.

Connect directly to the security database using:

[[See Video to Reveal this Text or Code Snippet]]

Execute:

[[See Video to Reveal this Text or Code Snippet]]

Alternative Mapping Approach

You can also create a mapping strategy that directs legacy authentication attempts to a different user account:

[[See Video to Reveal this Text or Code Snippet]]

Dropping the SYSDBA Account for Srp Plugin

If you prefer to drop the SYSDBA account for the Srp plugin, execute:

[[See Video to Reveal this Text or Code Snippet]]

Conclusion

Dealing with Firebird's password handling across authentication plugins can be tricky, but with these steps, you can manage and update your SYSDBA password effectively. By following our structured approach, you can eliminate the old password from access metadata, ensuring a secure and streamlined experience with your Firebird setup.

Feel free to revisit the outlined steps anytime you face similar issues in the future!