Firebird 3 WireCrypt Required with Srp Only Authentication – Remote Legacy Client Connection Fails

Direct answer

Set AuthServer = Srp, Legacy_Auth in firebird.conf. Firebird 3 evaluates authentication plugins in the order listed, so any client whose fbclient library supports Srp negotiates Srp first; only clients that cannot offer Srp fall back to Legacy_Auth. Listing Legacy_Auth second does not downgrade Srp-capable clients.

WireCrypt = Required is orthogonal to the plugin list. It forces wire-protocol encryption on every accepted connection regardless of which authentication plugin was negotiated, so both the Srp path and the Legacy_Auth path are encrypted on the wire. It does not influence which plugin is chosen.

What this does and does not fix

Wire encryption protects the Legacy_Auth handshake from passive sniffing on the network, but it does not repair Legacy_Auth's inherent weakness: the effective 8-character DES-based password hash. Anyone who can reach the port can attempt the weaker path, and captured hashes remain crackable. Treat Legacy_Auth as a transitional compatibility measure, not a permanent configuration.

Isolating legacy authentication

The cleanest isolation is a second Firebird instance with its own firebird.conf, its own port (RemoteServicePort), and AuthServer = Legacy_Auth, while the main instance stays Srp-only. Point legacy clients at the legacy port and restrict that port with firewall rules to the known source addresses of the legacy machines. This keeps the weak plugin unreachable from the general network. Per-database overrides in databases.conf can further scope which databases the legacy instance exposes.

The better long-term fix is client-side: the plugin a client offers is determined by its fbclient library, not the server. Deploying a Firebird 3-capable fbclient (with AuthClient including Srp) to the legacy machines usually removes the need for Legacy_Auth entirely, even if the application itself is old.

Verification steps

1. Set AuthServer = Srp, Legacy_Auth and WireCrypt = Required, then restart the Firebird service — config changes do not apply to a running server.
2. Connect with a Firebird 3 fbclient and confirm the session used Srp (for example via the monitoring tables such as MON$ATTACHMENTS or server logs).
3. Connect with a genuine legacy client and confirm it succeeds only through the fallback.
4. Attempt a connection with encryption disabled on the client and confirm it is rejected, proving WireCrypt = Required applies to both auth paths.

Assumptions and caveats

This applies to Firebird 3 parameter names and negotiation behavior. Firebird 4 changed defaults (for example Srp256) and some details, so confirm against the firebird.conf comments and release notes shipped with your exact installed version. Also note that Srp users must exist in the Srp user manager; accounts created only under the legacy user manager will not authenticate via Srp.