Firebird’s gsec User Management Utility

To display all users in the security database the command, and it’s output are:

To display details of a single user, pass the username as a parameter to the display command.

If you enter the name of a non-existent user as a parameter of the display command, nothing is displayed and gsec remains in interactive mode.

When adding a new user in interactive mode, nothing is displayed to confirm that the user was indeed added. You need to use the display or display <name> commands to make sure that the user was added successfully.

From Firebird 2.5 onwards, a new role — RDB$ADMIN — has been added to the security database. Gsec allows you to indicate whether new users are assigned this role. The display command has also been modified to show whether a user had this role or not.

When deleting a user in interactive mode, there is no confirmation that the user has been deleted. You should use the display or display <name> command to check.

If, on the other hand, you try to delete a non-existing user, gsec will display an error message, and exit.

Existing users can have one or more of their password, first name, middle name or lastname amended. There is no confirmation that your modification has worked, so you must use one of the display commands to determine how well it worked.

If you wish to remove one or more of a user’s attributes, don’t pass a (new) value for that attribute.

Now I can be known as 'the man with no name', just like Clint Eastwood !

From Firebird 2.5 onwards, a user’s admin rights can be modified using this command:

Since Firebird 2.1, Windows domain administrators have had full access to the user management functions. This meant that when an admin user connected to the server and then used gsec, they had the ability to modify any user account in the security database.

From Firebird 2.5 they do not get these privileges automatically unless the DBA has configured the security database to make it happen automatically. This is done either in isql as follows:

The command above will cause all Windows Administrator accounts to automatically have full access to the user management functions. The automatic mapping can be revoked as follows:

The functionality of the above isql commands can also be set using gsec, as follows, by using the -mapping command. The command takes a parameter of set or drop accordingly.

or:

The help command, in interactive mode, displays the same help screen as shown above. From Firebird 2.5, this can be abbreviated to a single question mark.

The version of gsec can be obtained using the z command.

Or, in gsec from Firebird 2.5:

To display all users in the security database the command, and its output are:

To display details of a single user, pass the username as a parameter to the display command.

When adding a user in batch mode, there is no confirmation that the user has been added. You should use the -display or -display <name> command to check.

Under Firebird 2.5, the -admin parameter may be specified:

When deleting a user in batch mode, there is no confirmation that the user has been deleted. You should use the -display or -display <name> command to check.

Existing users can have one or more of their password, first name, middle name, lastname or admin rights amended.

If you wish to remove one or more of a user’s attributes, don’t pass a (new) value for that attribute.

Now nobody knows who I am :o)

The version of gsec can be obtained using the -z command. However, note that it leaves you in interactive mode on completion. It doesn’t exit like the other batch mode commands do, so you have to use the interactive quit command to exit. There is a way around this problem as shown in the following. The first part shows the problem — which still exists in Firebird 2.5.

The solution is to have a small file containing the command quit and force gsec to read this file when it needs user input, as follows.

This could be a good idea for any of the commands which leave you 'stuck' in the interactive mode when you thought you were running in batch mode. By redirecting input from a command file, gsec will read a line of text from that file any time it requires user input. By forcing it to read the quit command, you make it exit.

Since Firebird 2.1, Windows domain administrators have had full access to the user management functions. This meant that when an admin user connected to the server and then used gsec, they had the ability to modify any user account in the security database.

The functionality that allows Windows domain administrators to have full access to the user management functions of the Firebird’s security database, can also be set using gsec on the command line as follows, by using the -mapping command. The command takes a parameter of set or drop accordingly.

or:

Only a privileged user can update the security database. Normal users can run the gsec utility, but can only list the contents under Firebird 1.5. The following shows what happens when trying to update the database when running gsec as a normal user.

A normal users can only display details from the security database.

The above user, running under Firebird 2.0 would see the following:

The gsec commands apply to both modes of operation, however, when running in batch mode, you must prefix the command name with a minus sign (-) or you will get an error message similar to the following:

Note also that you will be left in interactive mode when an error occurs. The correct command line should have a minus in front of the display command, as follows:

This time, gsec performed its duties, displayed all known users and quit from the utility.

When running gsec under windows, you can trap the exit code in %ERRORLEVEL% and check it to determine the success or failure of the last command executed.

When your operating system is Unix — whatever flavour — the exit code is to be found in the $? variable.

Unfortunately, using the version of gsec supplied with Firebird 1.5, it appears that gsec always exits with a zero and this makes it quite unsuitable to build into a properly error trapped batch script on either system. Sad but true.

Sometimes, when running in batch mode, an error condition in gsec will result in gsec switching over to interactive mode. This is not very useful if you started gsec in batch mode from a script, because your script will just sit there waiting on something to be typed.

Up until Firebird 2.0, running any of the Firebird utilities with a password supplied on the command line meant that anyone logged on to the same server could call ps -efx|grep -i pass (or similar) and be able to see the SYSDBA or other passwords. From Firebird 2.0 this is no longer possible as Firebird now replaces the supplied password with spaces.