The Firebird server — and any databases you create or connect to — must reside on a hard drive that is physically connected to the host machine.You cannot locate components of the server, or any database, on a mapped drive, a filesystem share or a network filesystem.(Well, you can, but you shouldn’t, and this technique isn’t covered here.)

Although it is possible to install Firebird by a filesystem copying method — such as untarring a snapshot build or decompressing a .zip archive — it is strongly recommended that you use the distributed release kit (.exe for Windows, .tar.gz for Linux), especially if this is the first time you install Firebird.The Windows installation executable, and the install.sh script in the official .tar.gz for various POSIX platforms all perform some essential setup tasks.Provided you follow the installation instructions correctly, there should be nothing for you to do upon completion but log in and go!

Some installers ask you to choose between Classic, SuperClassic and SuperServer mode.What are they?

Each mode is fully stable and there is no reason to categorically prefer one to the other.Of course, you may have your own specific considerations.When in doubt, just follow the installer default for now.Changing the server mode later can be done via the configuration file firebird.conf and requires a restart but not reinstallation.The server mode can even be configured per database (consult the Firebird 3.0 Release Notes for details).

The installer requires Administrator privileges, and Windows will prompt you for privilege elevation when run.

On Windows Server platforms Firebird will run as a system service by default, but during installation you can also choose to let it run as an application.Don’t do this unless you have a compelling reason.If you do want to run Firebird as an application, it is recommended to install it outside the Program Files folder to ensure you have sufficient access rights.

During installation, you have the option of providing a password for Firebird’s superuser, SYSDBA.Firebird passwords may be up to 255 bytes long, but due to the nature of the hashing algorithm used by the Srp plugins the “effective length” is around 20 bytes, so it’s not very useful to enter a password that’s much longer than that.Notice however that if you do enter such a password, you must supply it in its full length every time you connect — it won’t work if you truncate it to the first 20 characters!

The Firebird Guardian is a utility that monitors the server process and tries to restart it if it terminates abnormally.During a Windows install, you can opt to use the Guardian when running in SuperClassic or Superserver mode.However, since Windows has the facility to watch and restart services, there is no reason to use the Guardian if Firebird runs as a service (which it should).

The Guardian may be phased out in future versions of Firebird.

In all cases, read the Release Notes for the Firebird version you’re going to install.There may be significant variations from release to release of any POSIX operating system, especially the open source ones.Where possible, the build engineers for each Firebird version have attempted to document any known issues.

Aside from being packaged with the download kits, Release Notes for all officially released versions of Firebird can also be found at https://www.firebirdsql.org/en/release-notes/.

For Linux distributions, use the .tar.gz kit.Quite often, installation is just a matter of untarring the archive and running install.sh.In some cases, the Release Notes or packed Readmes may instruct you to edit the scripts and make some manual adjustments.

Firebird allows the operation of multiple servers on a single machine.It can also run concurrently with Firebird 1.x or InterBase servers.Setting this up is not a beginner’s task though.If you need to run multiple servers on the same machine, the second and subsequent servers must be installed and configured manually.They need to have different service names and should listen on different TCP/IP ports.The file install_windows_manually.txt in the doc subdirectory may be of help if you’re doing this on Windows, but bear in mind that it was written for Firebird 2.1.

Also read the chapter Configuring the Port Service on Client and Server in the Firebird 1.5 (!) Release Notes:

https://www.firebirdsql.org/file/documentation/release_notes/html/rlsnotes15.html#config-port
https://www.firebirdsql.org/file/documentation/release_notes/Firebird-1.5.6-ReleaseNotes.pdf#page=96

If you want to connect to your Firebird server across a network, then before testing the Firebird server itself, you may want to verify that the server machine is reachable from the client at all.At this point, it is assumed that you will use the TCP/IP network protocol for your Firebird client/server connections.

The ping command — available on most systems — is a quick and easy way to see if you can connect to a server machine via the network.For example, if your server’s IP address in the domain that is visible to your client is 192.13.14.1, go to a command shell on the client machine and type the command

substituting this example IP address with the IP address that your server is broadcasting.If you are on a managed network, and you don’t know the server’s IP address, ask your system administrator.Of course, you can also ping the server by its name, if you know it:

If you are connecting to the server from a local client — that is, a client running on the same machine as the server — you can ping the virtual TCP/IP loopback:

or

If you have a simple network of two machines linked by a crossover cable, you can set up your server with any IP address you like except 127.0.0.1 (which is reserved for a local loopback) and, of course, the IP address which you are using for your client machine.If you know the “native” IP addresses of your network cards, and they are different, you can simply use those.

Once you have verified that the server machine is reachable from the client, you can go on to the next step.

Most — but not all — installation packages start up the Firebird server as one of the final steps during installation, and also make sure that Firebird is started at every reboot.

After being launched, the Firebird server should be running:

The following sections show you how to test the server on each platform.

Use the top command in a command shell to inspect the running processes interactively.If a Firebird 5 server is running, you should see a process named firebird and possibly also fbguard (the Guardian process).

The following screen shows the output of top, restricted by grep to show only lines containing the string firebird:

As an alternative to top, you can use ps -ax or ps -aux and pipe the output to grep.

The process name is firebird regardless if Firebird is running in Superserver, Classic or SuperClassic mode.However, it is possible to configure a Classic-mode Firebird in such a way that it runs as a service under (x)inetd.In that case, you will only see a firebird process if a client connection has been made.

Another way of testing the server after installation is by starting a Firebird client (e.g. /opt/firebird/bin/isql) and connecting to a database or creating one.These operations are described later in this guide.

If it turns out that the server hasn’t been started after all, you may need to do this manually, e.g.with /etc/init.d/firebird start or systemctl start firebird and systemctl enable firebird, depending on the type of Linux system and your Firebird installation package.

Use kbd:[Win+R], type services.msc followed by kbd:[Enter] or btn:[OK], or click btn:[Start] (or kbd:[Win]) and search for “Services” and open the “Services” app.

This illustration shows the Services applet display on Windows 11.The appearance may vary by Windows edition and configuration.

You should at least find the Firebird server in the services listing.The Guardian may or may not be running, depending on the choices you made during installation.If you didn’t opt to start the server at the end of the installation process, you may do so now by right-clicking on the Firebird entry (or the Guardian) and choosing Start.

If Firebird is up and running as an application, it is represented by an icon in the system tray:

A flashing icon indicates that the server is in the process of starting up (or at least trying to do so).A red icon, or an icon with an overlying red stop sign, indicates that startup has failed.

One way to make 100% sure if the server is running or not is to press kbd:[Ctrl+Alt+Del], select Task Manager, and look for the firebird process (and possibly fbguard) in the task list.You may need to check the box “Show processes of all users” for these processes to become visible.

On some occasions, you may need to start the Guardian or server once explicitly via the Start menu even if you opted for “Start Firebird now” at the end of the installation process.Sometimes a reboot is necessary.

You can shut the server down via the menu that appears if you right-click on the tray icon.Notice that this also makes the icon disappear;you can restart Firebird via the Start menu.

Each remote client machine needs to have the client library — libfbclient.so on POSIX clients, fbclient.dll on Windows clients — that matches the release version of the Firebird server.

Firebird can install symlinks or copies named after the 1.0 libs (with the “old” InterBase names), to maintain compatibility with third-party products which need these files.

Some extra pieces are also needed for the client-only install.

No separate installation program is available to install only the client pieces on a Windows machine.If you are in the common situation of running Windows clients to a Linux or other Unix-like Firebird server (or another Windows machine), you need to download the full Windows installation kit that corresponds to the version of Firebird server you install on your server machine.

Fortunately, once you have the kit, the Windows client-only install is a breeze.Just run the installation program and when you arrive at the “Select Components” screen, choose one of the client-only options from the drop-down list or uncheck the “Server Components” checkbox.

A small-footprint client install program for Linux clients is not available either.Additionally, some POSIX flavours — even within the Linux constellation — have somewhat idiosyncratic requirements for filesystem locations.For these reasons, not all *nix distributions for Firebird even contain a client-only install option.

For most Linux flavours, the following procedure is suggested for a manual Firebird client-only install.Log in as root for this.

Instead of copying the files from a server, you can also pull them out of a Firebird tar.gz kit.Everything you need is located in the /opt/firebird tree within the buildroot.tar.gz archive that’s packed inside the kit.

The following table shows the default component locations of a Firebird installation on Linux.Some locations may be different on other Unix-like systems, or on certain Linux distributions.

In the table below, %ProgramFiles% refers to the Windows programs folder.This is usually “C:\Program Files” but may also be a different path, e.g. “D:\Programmi”.Likewise, %windir% refers to the Windows directory.Be sure to read the notes below the table, especially if you’re running Firebird on a 64-bit Windows system.

Since Firebird 3, user management is done entirely through SQL commands.Users of previous versions are probably familiar with the gsec utility for this task.It is still present, but deprecated, and it won’t be discussed here.

One Firebird account is created automatically as part of the installation process: SYSDBA.This account has all the privileges on the server and cannot be deleted.Depending on version, OS, and architecture, the installation program will either

If the password is masterkey and your server is exposed to the Internet at all — or even to a local network, unless you trust every user with the SYSDBA password — you should change it immediately.Fire up isql or another Firebird client and connect to a database.In this example, the “employee” example database is used, because its alias is always present in a freshly installed Firebird setup:

If you do this in isql, it should respond with:

Now alter the sysdba password:

If the command succeeds, you won’t get any feedback.Instead, isql will just print the next “SQL>”-prompt, thus indicating that all is well and your further input is awaited.

Please notice that unlike “regular” usernames, Firebird passwords are always case-sensitive.

Firebird allows the creation of many different user accounts.Each of them can own databases and also have various types of access to databases and database objects it doesn’t own.

Assuming you are connected to a database as SYSDBA, you can add a user account as follows:

The full range of user management commands is:

Tags are optional key-value pairs that can be freely defined by the user.The key (tag name) must be a valid SQL identifier, the value a non-NULL string of at most 255 bytes.

Only SYSDBA and co-admins can use all these commands.Ordinary users can change their own parameters (such as password, name parts and tags, but not active/inactive) using ALTER USER name or ALTER CURRENT USER.It is not possible to change an account name.

Examples:

For details on managing users through SQL, also see the Firebird 5.0 Language Reference, section SQL Statements for User Management.

Firebird user accounts are kept in a security database, which normally resides in the installation directory and is called security5.fdb (alias: security.db).Except in the case of so-called embedded connections (more about those later in this guide), connecting to a database always involves the security database, against which the user credentials are verified.Of course this is done transparently;the user doesn’t have to make an explicit connection to the security database.

However, in Firebird 5 this is not the end of the story.Firebird — since Firebird 3 — allows the use of multiple security databases on a system, each security database governing a specific set of databases.A database can even act as its own security database.

Showing how to set this up is outside the scope of this Quick Start Guide.You can find full details in the Firebird 3.0 Release Notes, chapter Security.But it is important to realise that if a system has multiple security databases, managing user accounts while connected to a database will always affect the accounts in the security database that governs that specific database.To be on the safe side, you may want to connect to the security database itself before issuing your user management commands.Connecting to the security database used to be forbidden in recent versions of Firebird, but is now once again possible, albeit by default only locally using embedded or — on Windows — XNET (which means that even the localhost route is blocked).

In Firebird 2.5 and up, SYSDBA (and others with administrator rights) can appoint co-administrators.This is done with the GRANT ADMIN ROLE directive:

The first command creates user bigbill as a Firebird administrator, who can add, alter and drop users.The second command grants administrator privileges to the existing user littlejohn.

To revoke administrator privileges from an account, use ALTER USER …​ REVOKE ADMIN ROLE.

Firebird 5 offers a number of security options, designed to make unauthorised access as difficult as possible.

It pays to familiarise yourself with Firebird’s security-related configuration parameters.You can significantly enhance your system’s security if you raise the protection level wherever possible.This is not only a matter of setting parameters, by the way: other measures involve tuning filesystem access permissions, an intelligent user accounts policy, etc.

Below are some guidelines for protecting your Firebird server and databases.

The Firebird kit does not come with a GUI admin tool.It does have a set of command-line tools — executable programs which are located in the bin subdirectory of your Firebird installation (on Windows, they are in the installation directory itself).One of them, isql, has already been introduced to you.

The range of excellent GUI tools available for use with a Windows client machine is too numerous to describe here.At least one of them, FlameRobin, is also available for Linux.

Explore the following sites for more options:

If you want to connect to a database or create one you have to supply, amongst other things, a connection string to the client application (or, if you are a programmer, to the routines you are calling).A connection string uniquely identifies the location of the database on your computer, local network, or even the Internet.

An explicit local connection string consists of the path + filename specification in the native format of the filesystem used on the server machine, for example

Many clients also allow relative path strings (e.g. “..\examples\empbuild\employee.fdb”), but you should use these with caution, as it’s not always obvious how they will be expanded.Getting an error message is annoying enough, but applying changes to another database than you thought you were connected to may be disastrous.

Instead of a file path, the local connection string may also be a database alias that is defined in databases.conf, as mentioned earlier.The format of the alias depends only on how it’s defined in the configuration file, not on the server filesystem.Examples are:

Upon receiving a local connection string, the Firebird client will first attempt to make a direct, embedded connection to the database file, bypassing authentication but respecting the SQL privileges and restrictions of the supplied user and/or role name.That is, if the Engine13 provider is enabled in firebird.conf or databases.conf — which it is by default.If the database file exists, but the connection fails because the client process doesn’t have the required access privileges to the file, a client-server connection is attempted (by the Loopback provider), in this order:

You can force Firebird to use a certain protocol (and skip the embedded connection attempt) by prepending the protocol in URL style:

Firebird has two forms of TCP/IP connection strings:

With:

Examples:

Notice how the aliased connection strings don’t give any clue about the server OS.And they don’t have to, either: you talk to a Linux Firebird server just like you talk to a Windows Firebird server.In fact, specifying an explicit database path is one of the rare occasions where you have to be aware of the difference.

The syntax for XNET URLs is:

xnet://<path-or-alias>

Since XNET is a purely local protocol, you can’t include a hostname or port.

Support for NetBEUI (named pipes, a.k.a. WNET) connections was removed in Firebird 5.

Please be aware that some third-party client programs may have different requirements for the composition of connection strings.Refer to their documentation or online help to find out.

A sample database named employee.fdb is located in the examples/empbuild subdirectory of your Firebird installation.It is also reachable under its alias employee.You can use this database to “try your wings”.

If you move or copy the sample database, be sure to place it on a hard disk that is physically attached to your server machine.Shares, mapped drives or (on Unix) mounted SMB (Samba) file systems will not work.The same rule applies to any databases that you create or use.

Connecting to a Firebird database requires — implicit or explicit — authentication.To work with objects inside the database, such as tables, views and functions, you (i.e. the Firebird user you’re logged in as) need explicit permissions on those objects, unless you own them (you own an object if you have created it) or if you’re connected as user SYSDBA or with the role RDB$ADMIN.In the example database employee.fdb, sufficient permissions have been granted to PUBLIC (i.e. any authenticated user) to enable you to view and modify data to your heart’s content.

For simplicity here, we will look at authenticating as SYSDBA using the password masterkey.Also, to keep the lines in the examples from running off the right edge, we will work with local databases and use aliases wherever possible.Of course, everything you’ll learn in these sections can also be applied to remote databases, simply by supplying a TCP/IP connection string.

Firebird ships with a text-mode client named isql (Interactive SQL utility).You can use it in several ways to connect to a database.One of them, shown below, is to start it in interactive mode.Go to the directory where the Firebird tools reside (see [qsg5-disk-locations] if necessary) and type isql (Windows) or ./isql (Linux) at the command prompt.

At this point, isql will inform you that you are connected:

You can now continue to play about with the employee database.With isql you can query data, get information about the metadata, create database objects, run data definition scripts and much more.

To get back to the OS command prompt, type:

You can also type EXIT instead of QUIT, the difference being that EXIT will first commit any open transactions, making your modifications permanent.

Some GUI client tools take charge of composing the CONNECT string for you, using server, path (or alias), username and password information that you type into prompting fields.Supply the various elements as described in the preceding topic.

There is more than one way to create a database with isql.Here, we will look at one simple way to create a database interactively — although, for your serious database definition work, you should create and maintain your metadata objects using data definition scripts.

To create a database interactively using the isql command shell, type isql (Windows) or ./isql (Linux) at the command prompt in the directory where the Firebird tools are.

Now you can create your new database interactively.Let’s suppose that you want to create a database named test.fdb and store it in a directory named data on your D drive:

The database will be created and, after a few moments, the SQL prompt will reappear.You are now connected to the new database and can proceed to create some test objects in it.

To verify that there really is a database there, let’s first type in this query:

Although you haven’t created any tables yet, the screen will fill up with a large amount of data!This query selects all rows in the system table RDB$RELATIONS, where Firebird stores the metadata for tables.An “empty” database is not really empty: it contains a number of system tables and other objects.The system tables will grow as you add more user objects to your database.

To get back to the command prompt type QUIT or EXIT, as explained in the section on connecting.

In Firebird 5, if you try to create a database other than in embedded mode as someone who is not a Firebird admin (i.e. SYSDBA or an account with equal rights), you may be in for a surprise:

Non-admin users must explicitly be granted the right to create databases by a Firebird admin:

After that, they can create databases.

Notice that with a serverless connection, i.e. without specifying a host name or protocol before the database name (and Engine13 enabled!), Firebird won’t deny any CREATE DATABASE statement.It will only fail if the client process doesn’t have sufficient rights in the directory where the database is to be created.

Every database management system has its own idiosyncrasies in the ways it implements SQL.Firebird adheres to the SQL standard more rigorously than most other RDBMSes.Developers migrating from products that are less standards-compliant often wrongly suppose that Firebird is quirky, whereas many of its apparent quirks are not quirky at all.

Firebird accords with the SQL standard by truncating the result (quotient) of an integer/integer calculation to the next lower integer.This can have bizarre results unless you are aware of it.

For example, this calculation is correct in SQL:

If you are upgrading from an RDBMS which resolves integer/integer division to a float quotient, you will need to alter any affected expressions to use a float or scaled numeric type for either dividend, divisor, or both.

For example, the calculation above could be modified thus to produce a non-zero result:

Strings in Firebird are delimited by a pair of single quote (apostrophe) symbols: 'I am a string' (ASCII code 39, not 96).If you used earlier versions of Firebird’s relative, InterBase®, you might recall that double and single quotes were interchangeable as string delimiters.Double quotes cannot be used as string delimiters in Firebird SQL statements.

If you need to use an apostrophe inside a Firebird string, you can “escape” the apostrophe character by preceding it with another apostrophe.

For example, this string will give an error:

because the parser encounters the apostrophe and interprets the string as 'Joe' followed by some unknown keywords.To make it a legal string, double the apostrophe character:

Notice that this is two single quotes, not one double-quote.

You can also use the alternative quote string literal, allowing you to embed the quote without escaping:

The concatenation symbol in SQL is two “pipe” symbols (“||”, or a pair of ASCII 124 without space between).In SQL, the “+” symbol is an arithmetic operator, and it will cause an error if you attempt to use it for concatenating strings.The following expression prefixes a character column value with the string “Reported by:”:

Firebird will raise an error if the result of a string concatenation exceeds the maximum (var)char size of 32 Kb.If only the potential result — based on variable or field size — is too long you’ll get a warning, but the operation will be completed successfully.(In pre-2.0 Firebird, this too would cause an error and halt execution.)

See also the section below, [qsg5-nulls], about concatenating in expressions involving NULL.

Before the SQL-92 standard, it was not legal to have object names (identifiers) in a database that duplicated keywords in the language, were case-sensitive or contained spaces or special characters^[1].SQL-92 introduced a new syntax to make any of them legal, provided that the identifiers are defined within pairs of double-quote symbols (ASCII 34) and were always referred to using double-quote delimiters (so called quoted or delimited identifiers).

The purpose of this “gift” was to make it easier to migrate metadata from non-standard RDBMSes to standards-compliant ones.The downside is that, if you choose to define an identifier in double quotes, its case-sensitivity and the enforced double-quoting will remain mandatory.

Firebird does permit a slight relaxation under a very limited set of conditions.If the identifier which was defined in double-quotes:

...then it can be used in SQL unquoted and case-insensitively.(But as soon as you put double-quotes around it, you must match the case again!)

Unless you have a compelling reason to define quoted identifiers, it is recommended that you avoid them.Firebird happily accepts a mix of quoted and unquoted identifiers — so there is no problem including that keyword which you inherited from a legacy database, if you need to.

In SQL, NULL is not a value.It is a condition, or state, of a data item, in which its value is unknown.Because it is unknown, NULL cannot behave like a value.When you try to perform arithmetic on NULL, or involve it with values in other expressions, the result of the operation will almost always be NULL.It is not zero or blank or an “empty string”, and it does not behave like any of these values.

Below are some examples of the types of surprises you will get if you try to perform calculations and comparisons with NULL.

The following expressions all return NULL:

You might have expected 6 from the first expression and “Home sweet” from the third, but as we just said, NULL is not like the number 0 or an empty string — it’s far more destructive!

The following expression:

will return NULL if either FirstName or LastName is NULL.Otherwise, it will nicely concatenate the two names with a space in between — even if any one of the variables is an empty string.

Now let’s examine some PSQL (Procedural SQL) examples with if-constructs:

Firebird 2 and above implement IS [NOT] DISTINCT allowing you to perform (in)equality tests that take NULL into account.The semantics are as follows:

Notice that if neither operand is NULL, IS DISTINCT works exactly like the “<>” operator, and IS NOT DISTINCT like the “=” operator.

IS DISTINCT and IS NOT DISTINCT always return true or false, never NULL.

Using DISTINCT, you can rewrite the first PSQL example as follows:

And the second as:

These versions will give you the results that a normal (i.e. not SQL-brainwashed) human being would expect, whether there are NULLs involved or not.

A lot more information about NULL behaviour can be found in the Firebird Null Guide, at these locations:

https://www.firebirdsql.org/file/documentation/html/en/firebirddocs/nullguide/firebird-null-guide.html (HTML)
https://www.firebirdsql.org/file/documentation/pdf/en/firebirddocs/nullguide/firebird-null-guide.pdf (PDF)

Firebird comes with two utilities for backing up and restoring your databases: gbak and nbackup.Both can be found in the Firebird installation directory (Windows) or its bin subdirectory (Linux).Firebird databases can be backed up while users are connected to the system and going about their normal work.The backup will be taken from a snapshot of the database at the time the backup began.

Regular backups and occasional restores should be a scheduled part of your database management activity.

More information about gbak can be found here (HTML and PDF version, same content):

https://www.firebirdsql.org/file/documentation/html/en/firebirddocs/gbak/firebird-gbak.html
https://www.firebirdsql.org/file/documentation/pdf/en/firebirddocs/gbak/firebird-gbak.pdf

The nbackup manual is here (again same content in HTML and PDF):

https://www.firebirdsql.org/file/documentation/html/en/firebirddocs/nbackup/firebird-nbackup.html
https://www.firebirdsql.org/file/documentation/pdf/en/firebirddocs/nbackup/firebird-nbackup.pdf

The following sections constitute a summary of things not to do if you want to keep your Firebird databases in good health.

Firebird is installed with forced writes (synchronous writes) enabled by default.Modifications are written to disk immediately upon posting.

It is possible to configure a database to use asynchronous data writes — whereby modified or new data are held in the memory cache for periodic flushing to disk by the operating system’s I/O subsystem.The common term for this configuration is forced writes off (or disabled).It is sometimes resorted to in an attempt to improve performance during large batch operations.

The big warning here is: do not disable forced writes on a Windows server.It has been observed that the Windows server platforms do not flush the write cache until the Firebird service is shut down.Apart from power interruptions, there is just too much that can go wrong on a Windows server.If it should hang, the I/O system goes out of reach and your users' work will be lost in the process of rebooting.

Linux servers are safer for running an operation with forced writes disabled temporarily.Still, do not leave it disabled once your large batch task is completed, unless you have a very robust fall-back power system.

One of the restore options in the gbak utility (gbak -rep[lace_database]) allows you to restore a gbak file over an existing database.It is possible for this style of restore to proceed without warning while users are logged in to the database.Database corruption is almost certain to be the result.

If is practicable to do so, it is recommended to restore to spare disk space using the gbak -c option and test the restored database using isql or your preferred admin tool.If the restored database is good, shut down the old database (you can use the gfix command-line tool for this;see Firebird Database Housekeeping Utility (HTML) or Firebird Database Housekeeping Utility (PDF)).Make a filesystem copy of the old database just in case and then copy the restored database file(s) over their existing counterparts.

If you do not block access to users while performing a restore using gbak -rep then users may be able to log in and attempt to do operations on data.Corrupted structures will result.