Why can I ALWAYS get into Firebird (no security) lazarus / 16-Databases ---------------------------------------------------------------------- RedOctober · 2019-01-21 16:33 Platform:  Lazarus 1.8.4, FPC 3.0.4, IBX Firebird components 2.3.3, Firebird WI-V3.0.4.33054 OS:  Windows Server 2016 I do not have any Auto-Admin mapping configured in Firebird.  I'm using all the athentication defaults that come with a clean install. My TIBDatabase Database Connection Editor settings are: Connection = Local Protocol = Local Parameters are: user_name=SYSDBA password=masterkey  <-- Which is correct, I have not changed it on my development machine. I have the database alias configured in databases.conf as: # # Live Databases: # RUBI = D:\mypath\mydatabase.fdb My login code in Lazarus is: Code: Pascal  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i  // Can we connect to the DB?  dmMain.fb_db.Connected := False;  dmMain.fb_db.Params.Values['user_name'] := login_id;  <-- I enter 'Dogpile'  dmMain.fb_db.Params.Values['password'] := login_pwd;  <-- I enter 'Patch'   try    dmMain.fb_db.Connected := True;  <--- ALWAYS SUCCEEDS!    Result := True;  I cannot have any random person on my network being able to log in to my Firebird databases without security.  Even people who have permission to access one Firebird based app, may not have permission to access another Firebird based app.  What obvious thing I am doing wrong that is allowing me into my database, as if I have AutoAdmin mapping set up, which I don't!? I am manually ensuring the TIBDatabase component is not connected prior to compile and run, even though I have AllowedStreamedConnected set to FALSE (which should take care of that situation on it's own). I must have security where users must enter a valid login ID and password each time the log in and for each Firebird database app.  Thanks for your help. ---------------------------------------------------------------------- dsiders · 2019-01-21 17:43 Quote from: RedOctober on January 21, 2019, 05:33:09 pmPlatform:  Lazarus 1.8.4, FPC 3.0.4, IBX Firebird components 2.3.3, Firebird WI-V3.0.4.33054 OS:  Windows Server 2016 I do not have any Auto-Admin mapping configured in Firebird.  I'm using all the athentication defaults that come with a clean install. My TIBDatabase Database Connection Editor settings are: Connection = Local Protocol = Local Parameters are: user_name=SYSDBA password=masterkey  <-- Which is correct, I have not changed it on my development machine. I have the database alias configured in databases.conf as: # # Live Databases: # RUBI = D:\mypath\mydatabase.fdb My login code in Lazarus is: Code: Pascal  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i  // Can we connect to the DB?  dmMain.fb_db.Connected := False;  dmMain.fb_db.Params.Values['user_name'] := login_id;  <-- I enter 'Dogpile'  dmMain.fb_db.Params.Values['password'] := login_pwd;  <-- I enter 'Patch'   try    dmMain.fb_db.Connected := True;  <--- ALWAYS SUCCEEDS!    Result := True;  I cannot have any random person on my network being able to log in to my Firebird databases without security.  Even people who have permission to access one Firebird based app, may not have permission to access another Firebird based app.  What obvious thing I am doing wrong that is allowing me into my database, as if I have AutoAdmin mapping set up, which I don't!? I am manually ensuring the TIBDatabase component is not connected prior to compile and run, even though I have AllowedStreamedConnected set to FALSE (which should take care of that situation on it's own). I must have security where users must enter a valid login ID and password each time the log in and for each Firebird database app.  Thanks for your help. Are you using the embedded engine? It uses the user name to get SQL permissions but doesn't perform authentication. This sounds like the situation you're describing. ---------------------------------------------------------------------- RedOctober · 2019-01-21 19:26 I have installed Firebird from the file: Firebird-3.0.4.33054_0_x64.exe I got it from: https://firebirdsql.org/en/firebird-3-0/ Nothing in the docs says that this is the Embedded engine.  Was there a checkbox or something I needed to uncheck to prevent the embedded engine from installing on my Windows Server 2016 box? My understanding is that the Embedded engine installer is only the Android install file.  Is that correct? ---------------------------------------------------------------------- dsiders · 2019-01-22 00:33 Quote from: RedOctober on January 21, 2019, 08:26:36 pmI have installed Firebird from the file: Firebird-3.0.4.33054_0_x64.exe I got it from: https://firebirdsql.org/en/firebird-3-0/ Nothing in the docs says that this is the Embedded engine.  Was there a checkbox or something I needed to uncheck to prevent the embedded engine from installing on my Windows Server 2016 box? My understanding is that the Embedded engine installer is only the Android install file.  Is that correct? It has nothing to do with Android. With Firebird 3 there is no special client for embedded. It is baked in to fbclient.dll. Maybe this will shed a little light: https://www.ibphoenix.com/files/Embedded_fb3.pdf I don't know if this is your issue, but embedded is the only option that disregards login security. ---------------------------------------------------------------------- tonyw · 2019-01-22 16:00 The rule is simple enough, if your DatabaseName property (the connect string) is set to a local database path with no prefix and you are using Firebird 3 or later then you automatically get the embedded engine as long as you have read/write access to the database file. You can force access via the Firebird server by adding the prefix "localhost:" to the connect string - but to properly prevent direct access you need to ensure that only the firebird server has read/write access to the database file(s).