Enable RemoteConnections with SSL versus Disable RemoteConnections and Use an SSH Tunnel: Which Approach Best Mitigates Unintentional Public Exposure?

Preventing Accidental Public Access in Firebird 4

The default configuration of Firebird 4 exposes the database on TCP port 3050 for any host that can reach the server. Two documented mitigation paths exist: Enable RemoteConnections and enforce SSL, or Disable RemoteConnections and rely on an SSH tunnel to reach the database. Each path addresses the same constraint—unintended public exposure—yet differs in complexity, deployment constraints, and security guarantees.

Unresolved SSL Configuration Issue

While the SSL setting can be enabled per database, Firebird’s documentation does not specify how cipher suites are selected during the handshake, nor does it expose a knob to enforce a minimum TLS version or a fixed cipher list. This ambiguity raises questions about the actual security posture when SSL is enabled.

• How does Firebird select cipher suites when both client and server support multiple options?
• Does Firebird provide a configuration option to enforce a minimum TLS version or a specific cipher list?
• What are the practical implications for legitimate remote clients when RemoteConnections is disabled and SSH tunneling is required?