Firebird SQL

• Open the AWS Marketplace and search for "Firebird SQL SecureAnyCloud".
• Click Continue to Subscribe, accept the terms, then click Continue to Configuration.
• Select your preferred Region and Software Version.
• Click Continue to Launch.
• Choose Launch through EC2 for full control over the instance configuration.
• Select your instance type (t3.small is recommended).
• Configure storage with a minimum of 20 GB gp3.
• Configure your Security Group with the inbound rules below, listed as port, protocol, source and purpose:

Port 22, TCP, from your IP: SSH access.

Port 3050, TCP, from your IP: the Firebird SQL database listener for remote connectivity.

Important: Restrict port 3050 to trusted IP addresses or application servers only.

• Select your EC2 key pair and launch the instance.

When your instance is running and has passed both status checks (2/2), connect over SSH:

ssh -i your-key.pem ec2-user@<public-ip-address>

To switch to the root user:

sudo su -

The SYSDBA password is generated randomly and stored on the instance. Read it with:

cat /stage/scripts/firebird_sysdba_password.log

Note this password. You need it to connect to the database.

To connect from the server command line, run isql as the root user:

isql -u sysdba

Enter the password from the firebird_sysdba_password.log file when prompted.

To connect remotely with a database client or GUI application, use these settings:

• Host: the public or private IP of your EC2 instance
• Port: 3050
• Username: SYSDBA
• Password: the value from /stage/scripts/firebird_sysdba_password.log

Create a new database in isql:

CREATE DATABASE '/opt/firebird/data/myapp.fdb' USER 'SYSDBA' PASSWORD 'your_password';

Create a table:

CREATE TABLE customers ( id INTEGER NOT NULL PRIMARY KEY, name VARCHAR(100), email VARCHAR(200), created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP );

Insert data:

INSERT INTO customers (id, name, email) VALUES (1, 'John Doe', 'john@example.com'); COMMIT;

Query data:

SELECT * FROM customers;

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Firebird SQL. Select the SecureAnyCloud listing and choose Select, then choose Continue on the subscription summary.

Pick an instance type of m5.large or larger. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet, and either create or select a security group that allows inbound port 22 from your management network. Leave the root volume at the default size or larger. The Firebird data volume is attached automatically from the image.

Select Launch instance. First-boot initialisation generates the SYSDBA password and starts Firebird. It takes a minute or so after the instance state becomes Running and the status checks pass.

The command below launches an instance from the SecureAnyCloud Firebird SQL Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens inbound port 22.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --metadata-options HttpTokens=required \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":30,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=firebird-01}]'

On success, the command prints a JSON document. Note the instance ID. Once the instance is running, retrieve its public address with aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Connect over SSH with the key pair you selected and the public IP address from Step 2. The SSH login user depends on the operating system of the AMI variant you launched. For the Firebird SQL 5.0 AMI on Ubuntu 24.04, the login user is ubuntu.

ssh <login-user>@<public-ip>

Wait until the instance has passed both EC2 status checks before you connect. The first-boot service runs before the SSH daemon is ready, so Firebird is initialised by the time you can log in.

The first-boot service generates a fresh SYSDBA superuser password for this instance and writes it, with the connection details, to /root/firebird-credentials.txt. Only the root user can read the file. Display it from your SSH session:

sudo cat /root/firebird-credentials.txt

The file looks like this, with a unique password on your instance:

# Firebird SQL 5.0 — Per-Instance Credentials
# Generated on first boot: Sat May 23 19:58:21 UTC 2026
#
# Open the isql shell with:
# /opt/firebird/bin/isql -user SYSDBA -password '<password below>' 'inet://127.0.0.1/employee'
# FIREBIRD_USER=SYSDBA FIREBIRD_SYSDBA_PASSWORD=<your generated password> FIREBIRD_HOST=127.0.0.1 FIREBIRD_PORT=3050 SAMPLE_DATABASE=inet://127.0.0.1/employee

First boot replaces the installer's transient SYSDBA password, so it no longer works. Use the generated password for every connection.

Firebird runs under systemd as the firebird-superserver service and starts automatically on boot. Confirm that it is active:

systemctl is-active firebird-superserver

The command prints active. Next, confirm that the Firebird wire protocol is listening. By default the engine binds to the loopback address 127.0.0.1 on port 3050, so it is reachable from the instance itself:

ss -tln | grep 3050

You should see a listening socket on 127.0.0.1:3050:

LISTEN 0 128 127.0.0.1:3050 0.0.0.0:*

The image provides /opt/firebird/bin/isql, the standard Firebird interactive SQL shell. Open an interactive session against the bundled employee sample database with the generated SYSDBA password. Replace <password> with the value from /root/firebird-credentials.txt:

/opt/firebird/bin/isql -user SYSDBA -password '<password>' 'inet://127.0.0.1/employee'

You can also run a single statement without entering the interactive shell, by piping it to standard input. To verify the connection non-interactively from your SSH session, run:

echo "SELECT 'roundtrip-ok' FROM RDB\$DATABASE;" \
  | /opt/firebird/bin/isql -user SYSDBA -password '<password>' 'inet://127.0.0.1/employee' -q

The query returns the literal value you asked for:

CONSTANT ============ roundtrip-ok

Confirm the engine version with the -z flag, which prints the client and server banner:

/opt/firebird/bin/isql -z -q < /dev/null

The output names the Firebird release and the ODS (on-disk structure) version:

ISQL Version: LI-V5.0.3.1683 Firebird 5.0

The employee database is the canonical Firebird sample. It models a small company with departments, projects, jobs and salary history. List its tables from inside isql:

SHOW TABLES;

The shell prints the ten sample tables:

COUNTRY CUSTOMER DEPARTMENT EMPLOYEE EMPLOYEE_PROJECT JOB PROJECT PROJ_DEPT_BUDGET SALARY_HISTORY SALES

Describe a single table with SHOW TABLE, and run a normal SQL query to read rows. The example below joins the EMPLOYEE table with its job code and returns the first five rows:

SELECT FIRST 5 FIRST_NAME, LAST_NAME, JOB_CODE FROM EMPLOYEE;

FIRST_NAME LAST_NAME JOB_CODE =============== ==================== ======== Robert Nelson VP Bruce Young Eng Kim Lambert Eng Leslie Johnson Mktg Phil Forest Mngr

Type EXIT; to leave the isql shell.

To create a new database, use the CREATE DATABASE statement in an isql session. The example below creates a database called inventory.fdb on the dedicated data volume, with the SYSDBA password as the database owner credential. Replace <password> with your generated SYSDBA password:

/opt/firebird/bin/isql -user SYSDBA -password '<password>'

Inside the shell:

CREATE DATABASE 'inet://127.0.0.1//var/lib/firebird/inventory.fdb' USER 'SYSDBA' PASSWORD '<password>' PAGE_SIZE 16384 DEFAULT CHARACTER SET UTF8; CONNECT 'inet://127.0.0.1//var/lib/firebird/inventory.fdb' USER 'SYSDBA' PASSWORD '<password>'; CREATE TABLE products ( id INTEGER NOT NULL PRIMARY KEY, name VARCHAR(100) NOT NULL, price NUMERIC(10, 2) NOT NULL ); INSERT INTO products (id, name, price) VALUES (1, 'Mechanical Keyboard', 89.00); INSERT INTO products (id, name, price) VALUES (2, 'USB-C Hub', 39.00); COMMIT; SELECT * FROM products;

Type EXIT; to leave the shell. The new .fdb file is stored under /var/lib/firebird and is included in any EBS snapshot of the data volume.

Firebird database files are stored under /var/lib/firebird, which is a dedicated EBS volume separate from the operating system disk. Confirm the mount:

findmnt /var/lib/firebird

The output shows that /var/lib/firebird is its own ext4 filesystem on a separate device:

TARGET SOURCE FSTYPE OPTIONS /var/lib/firebird /dev/nvme1n1 ext4 rw,relatime

Because the data directory is on its own volume, you can take an Amazon EBS snapshot of it on its own schedule and grow it independently of the root volume. Check the available space at any time with:

df -h /var/lib/firebird

Filesystem Size Used Avail Use% Mounted on /dev/nvme1n1 20G 2.8M 19G 1% /var/lib/firebird

Firebird is managed through systemd, and the service starts automatically on boot.

Check the service status:

systemctl status firebird-superserver --no-pager

Stop, start and restart the service when needed:

sudo systemctl stop firebird-superserver
sudo systemctl start firebird-superserver
sudo systemctl restart firebird-superserver

Firebird writes its log files under /opt/firebird. The main log is /opt/firebird/firebird.log. Review it first when you diagnose a startup or runtime problem:

sudo tail -f /opt/firebird/firebird.log

The engine's main configuration file is /opt/firebird/firebird.conf. The image sets RemoteBindAddress = 127.0.0.1, so Firebird listens only on the loopback interface by default.

To accept connections from outside the instance, comment out that line or set it to a specific address. Then open inbound TCP 3050 on the EC2 security group and restart the service. The database aliases that clients can connect to by name are defined in /opt/firebird/databases.conf.

gbak is the Firebird logical backup and restore tool. It takes a consistent, hot backup of a running database into a single .fbk archive that you can restore on any platform Firebird supports. Replace <password> with your generated SYSDBA password:

sudo /opt/firebird/bin/gbak -user SYSDBA -password '<password>' \
  -backup -v \
  'inet://127.0.0.1/employee' \
  /var/lib/firebird/employee.fbk

The -v flag prints progress. To restore the archive to a new database file, run the inverse command:

sudo /opt/firebird/bin/gbak -user SYSDBA -password '<password>' \
  -restore -v \
  /var/lib/firebird/employee.fbk \
  'inet://127.0.0.1//var/lib/firebird/employee-restored.fdb'

The archive file is stored on the dedicated data volume, so it is included in any EBS snapshot you take of /var/lib/firebird. In production, schedule regular gbak runs with cron or a systemd timer, and copy the .fbk files to Amazon S3 for offsite retention.

For physical backups, nbackup takes incremental, block-level snapshots that complement gbak. See the upstream Firebird documentation at firebirdsql.org for the nbackup workflow.

gstat reports header page information and detailed page-level statistics for a Firebird database file. Use it to understand the on-disk layout and to diagnose performance issues:

sudo /opt/firebird/bin/gstat -user SYSDBA -password '<password>' \
  -h /var/lib/firebird/employee.fdb

The header dump reports the database page size, the ODS (on-disk structure) version, transaction counters and the platform Firebird was compiled for:

Database "/var/lib/firebird/employee.fdb" Database header page information: Flags 0 Generation 183 Page size 8192 ODS version 13.1 Implementation HW=AMD/Intel/x64 little-endian OS=Linux CC=gcc Database dialect 3

gsec is the security database administration tool. It creates, modifies and deletes Firebird user accounts. The example below creates a read-only application user called appuser and grants it SELECT on the employee tables. From a root shell, run:

sudo /opt/firebird/bin/gsec -user SYSDBA -password '<password>' \
  -add appuser -pw 'AppUserPass!' -fname 'Application' -lname 'User'

Then grant table privileges from isql:

/opt/firebird/bin/isql -user SYSDBA -password '<password>' 'inet://127.0.0.1/employee'

GRANT SELECT ON EMPLOYEE TO appuser; GRANT SELECT ON DEPARTMENT TO appuser; COMMIT; EXIT;

The new account can now log in to the employee database from a client tool with the password you set. Rotate the SYSDBA password regularly through the same gsec interface with -modify SYSDBA -pw '<new>'.

/opt/firebird/firebird.conf controls engine-wide settings. Common production changes include:

• DefaultDbCachePages: the per-database page cache size, in pages. Increase it for read-heavy workloads.
• RemoteBindAddress: the network address the engine listens on. Set it to a private IP to accept remote client connections.
• WireCrypt: set it to Required to force every client connection to use Firebird's built-in wire encryption.

After editing the file, restart the service so the new values take effect:

sudo systemctl restart firebird-superserver

Some changes require a reload of the security database, for example switching the authentication plugin. After such a change, restart the service and rerun a small isql command to confirm that the engine accepts the SYSDBA password under the new configuration.