Firebird 5

Open the Azure Portal, go to the Marketplace, search for Firebird SQL 5, and select the SecureAnyCloud publisher entry. Select Create to start the wizard.

On the Basics tab, choose your subscription, target resource group and region, and set the virtual machine name. Choose SSH public key as the authentication type. Enter a username of your choice (the examples below use azureuser) and paste your SSH public key. Standard_B2s is the recommended starting size.

On the Disks tab, the recommended OS disk type is Standard SSD. The Firebird database directory is /opt/firebird/data. If your working set is larger than a few gigabytes, attach a separate data disk now. After the server is running, bind mount the disk over the data directory.

On the Networking tab, select your existing virtual network and subnet. Attach a network security group that allows inbound TCP 22 from your management IP range. Allow inbound TCP 3050 only from the virtual network CIDR or from the application server subnets that need to reach the database.

Do not expose 3050 to the public internet. Firebird authentication is strong, but an exposed relational database is always a bad idea. The SYSDBA password is stored in plain text on the virtual machine by design, so that you can read it without a second trip.

On the Management, Monitoring and Advanced tabs, the defaults are appropriate. Select Review + create, wait for validation to pass, then select Create. Deployment takes around two minutes.

To deploy from the command line, accept the Marketplace terms once, then deploy from the Marketplace image URN:

RG="firebird-prod" LOCATION="eastus" VM_NAME="firebird-01" ADMIN_USER="azureuser" IMAGE_URN="sac1647283583153:firebird-5-ubuntu-22-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create \
  --resource-group "$RG" \
  --name firebird-vnet \
  --address-prefix 10.60.0.0/16 \
  --subnet-name firebird-subnet \
  --subnet-prefix 10.60.1.0/24 az network nsg create --resource-group "$RG" --name firebird-nsg az network nsg rule create \
  --resource-group "$RG" --nsg-name firebird-nsg \
  --name allow-ssh-mgmt --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" \
  --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create \
  --resource-group "$RG" --nsg-name firebird-nsg \
  --name allow-firebird-vnet --priority 110 \
  --source-address-prefixes 10.60.0.0/16 \
  --destination-port-ranges 3050 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:firebird-5-ubuntu-22-04:default:latest
az vm create \
  --resource-group "$RG" \
  --name "$VM_NAME" \
  --image "$IMAGE_URN" \
  --size Standard_B2s \
  --storage-sku StandardSSD_LRS \
  --admin-username "$ADMIN_USER" \
  --ssh-key-values "$SSH_KEY" \
  --vnet-name firebird-vnet --subnet firebird-subnet \
  --nsg firebird-nsg \
  --public-ip-address "" \
  --os-disk-size-gb 32

The --public-ip-address "" flag keeps the database off the public internet. Reach it through a bastion host or your existing private connectivity.

After deployment, find the private IP of the new virtual machine. From a host inside the same virtual network, connect over SSH:

ssh azureuser@<private-ip>

The first login may take a few seconds while cloud-init finishes. Once you have a shell, systemd has already started the server. The first-boot oneshot has already generated the per-VM SYSDBA password and created the default database.

The image generated a random SYSDBA password on this specific virtual machine and wrote it to a root-only file. Read it once with:

sudo cat /stage/scripts/firebird-credentials.log

The file contains lines similar to:

port=3050 default_database=/opt/firebird/data/demo.fdb sysdba_password=<random-password-unique-to-this-vm> sample_connect_local=/opt/firebird/bin/isql -user SYSDBA -password '<random-password>' /opt/firebird/data/demo.fdb sample_connect_remote=/opt/firebird/bin/isql -user SYSDBA -password '<random-password>' <vm-ip>:/opt/firebird/data/demo.fdb

Store the value of sysdba_password= in your secret store. After you copy the password, you can delete /stage/scripts/firebird-credentials.log. Keeping it readable by root only is also a reasonable default.

The Firebird command line client is installed at /opt/firebird/bin/isql. To put /opt/firebird/bin on your PATH, source the SecureAnyCloud environment helper:

source /usr/local/sbin/setEnv.sh

Or invoke isql by its full path in every command. This guide uses the full path, so every example is ready to copy and paste without relying on shell state.

Export the password as a shell variable so that you do not have to type it repeatedly:

export SYSDBA_PW="$(sudo awk -F= '/^sysdba_password=/ {print $2}' /stage/scripts/firebird-credentials.log)"
export FB_DB="$(sudo awk -F= '/^default_database=/ {print $2}' /stage/scripts/firebird-credentials.log)"

Connect to the demo database as SYSDBA:

/opt/firebird/bin/isql -user SYSDBA -password "$SYSDBA_PW" "$FB_DB"

The prompt looks like this:

Database: "/opt/firebird/data/demo.fdb", User: SYSDBA SQL>

Enter SHOW VERSION; to confirm the server version, then QUIT; to exit.

From a new shell, run a complete SQL round trip. This is the same smoke test that SecureAnyCloud runs in its build pipeline before shipping an image.

/opt/firebird/bin/isql -user SYSDBA -password "$SYSDBA_PW" "$FB_DB" <<'SQL' CREATE TABLE customers ( id INTEGER NOT NULL PRIMARY KEY, name VARCHAR(100), created TIMESTAMP DEFAULT CURRENT_TIMESTAMP ); COMMIT; INSERT INTO customers (id, name) VALUES (1, 'sac'); COMMIT; SELECT id, name, created FROM customers; QUIT; SQL

The SELECT returns one row: 1 SecureAnyCloud <timestamp>.

Transactions in Firebird are explicit. The COMMIT after each statement makes the changes durable. Without it, the rows stay in an uncommitted transaction and are lost when the session ends.

Firebird's remote connection string uses the HOST:PATH form, not the host:port/dbname style of PostgreSQL, MySQL or SQL Server. The path is the server-side absolute path to the .fdb file:

/opt/firebird/bin/isql -user SYSDBA -password '<pw>' <vm-ip>:/opt/firebird/data/demo.fdb

The same pattern works from any Firebird client, such as the FlameRobin GUI, DBeaver with the community Jaybird driver, or any JDBC/ODBC application. A JDBC URL looks like this:

jdbc:firebirdsql://<vm-ip>:3050//opt/firebird/data/demo.fdb

The double slash after the hostname is not a typo. It is the JDBC syntax for an absolute path on the server.

The image installs these components:

• Firebird server daemon: /opt/firebird/bin/fbguard and /opt/firebird/bin/firebird
• Firebird CLI (isql): /opt/firebird/bin/isql
• Firebird utilities (gbak, gfix, gsec, gstat, fbsvcmgr, qli): /opt/firebird/bin/
• Primary configuration file: /opt/firebird/firebird.conf
• Database aliases: /opt/firebird/databases.conf
• Database directory: /opt/firebird/data/
• Security database: /opt/firebird/security5.fdb
• Firebird log: /opt/firebird/firebird.log
• Systemd unit: /etc/systemd/system/firebird.service
• Environment helper: /usr/local/sbin/setEnv.sh

The image ships Firebird 5.0.4 from the official upstream tarball at github.com/FirebirdSQL/firebird. The exact installed version is recorded in /stage/scripts/BUILD_VERSIONS. Inspect it with cat /stage/scripts/BUILD_VERSIONS.

The image uses this layout:

• / (30 GB): root filesystem, including /opt/firebird
• /boot (1 GB): operating system kernel files
• /opt/firebird (on root): Firebird installation root
• /opt/firebird/data (on root): database files (.fdb)

For production, attach a separate Premium SSD data disk, format it, and bind mount it over /opt/firebird/data. This keeps database I/O off the root disk, which improves IOPS. It also lets you resize, snapshot or move the data volume independently of the operating system.

systemd starts and stops Firebird through the firebird.service unit.

Check service status:

systemctl status firebird.service

Stop Firebird:

sudo /usr/local/sbin/firebird-stop.sh
# equivalent to:
sudo systemctl stop firebird.service

Start Firebird:

sudo /usr/local/sbin/firebird-start.sh
# equivalent to:
sudo systemctl start firebird.service

Restart Firebird:

sudo systemctl restart firebird.service

Cannot connect to Firebird on port 3050

• Verify that the service is running: systemctl status firebird.service
• Verify that the listener is bound: ss -tln | grep 3050
• Check that RemoteAccess = true is set in /opt/firebird/firebird.conf
• Confirm that the network security group allows TCP 3050 from your client source IP
• Confirm that the virtual machine's NIC is in the expected subnet and has the NSG attached

isql returns "Your user name and password are not defined"

• Read the password from the credentials file again. The in-memory shell variable may have been truncated.
• Confirm that the SYSDBA user still exists: ls -l /opt/firebird/security5.fdb
• If you rotated the SYSDBA password after deployment, use the rotated value. /stage/scripts/firebird-credentials.log holds only the initial first-boot value.

Database file permission denied

• Check ownership: ls -l /opt/firebird/data/
• Files should be owned by firebird:firebird with mode 0640
• If you copied a .fdb from elsewhere, run sudo chown firebird:firebird <path>.fdb

Service fails to start

• Check the systemd journal: journalctl -u firebird.service --no-pager -n 50
• Check Firebird's own log: sudo tail -n 50 /opt/firebird/firebird.log
• Check filesystem space: df -h /opt/firebird
• Check for port conflicts: ss -tln | grep 3050

• Rotate the SYSDBA password after you first read it. Run ALTER USER SYSDBA PASSWORD '<new>' from an isql session connected to any database. The command operates on the security database, not on the database you connect to:

/opt/firebird/bin/isql -user SYSDBA -password "$SYSDBA_PW" "$FB_DB" <<'SQL' ALTER USER SYSDBA PASSWORD 'NewStr0ng!Pass'; COMMIT; QUIT; SQL

• Create application-specific users with CREATE USER and GRANT statements. Never let application code connect as SYSDBA.
• Restrict port 3050 to trusted application server subnets in your NSG.
• Enforce wire encryption by setting WireCrypt = Required in /opt/firebird/firebird.conf and restarting. Clients that do not support wire encryption are then refused.
• Back up regularly with gbak: gbak -backup -user SYSDBA -password '<pw>' <db> <backup.fbk>
• Keep Firebird updated by monitoring github.com/FirebirdSQL/firebird/releases. Apply point releases in place by stopping the service and extracting the tarball over /opt/firebird.
• Delete the credentials file once the SYSDBA password is in your secret store: sudo shred -u /stage/scripts/firebird-credentials.log

Firebird SQL is released under the Initial Developer's Public License (IDPL) and the Interbase Public License (IPL). There is no per-core, per-seat or per-server runtime licence fee. You can run Firebird on as many cores, sockets and virtual machines as you like without contacting the Firebird project for licensing purposes.

SecureAnyCloud provides commercial support for this image, separately from the upstream project. Contact us at any time for support questions, architectural advice or migration help.

• Email: sales@secureanycloud.com
• Website: secureanycloud.com
• Support hours: 24/7 with a guaranteed 24-hour response SLA

Deploy on Azure

Launch Firebird SQL 5 on Ubuntu 22.04 with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Launch Firebird SQL 5 on Ubuntu 22.04 on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com