Firebird 4.0: Disabling PUBLIC Role Membership to Prevent Accidental Public Access

Goal

Prevent unintended exposure of database objects by controlling the default PUBLIC role in Firebird 4.0.

Constraints & Uncertainty

The PUBLIC role is automatically granted to every user and cannot be revoked. Only privileges granted to PUBLIC can be revoked, which may break existing applications that rely on implicit PUBLIC rights. Firebird’s current configuration offers no toggle to disable PUBLIC role membership or to restrict its privileges automatically.

Current State

Firebird 4.0’s firebird.conf defaults to RemoteAccess=yes, exposing the server on port 3050 to any reachable host. Even with RemoteAccess disabled, a broad PUBLIC privilege set can still grant access to newly created users.

Open Questions

• Is there any forthcoming configuration option in Firebird to disable or limit PUBLIC role membership?
• What best‑practice patterns should be adopted to avoid granting broad rights to PUBLIC without breaking legacy applications?
• How does the RemoteAccess setting interact with PUBLIC role privileges when the server is exposed to external networks?