SecurityDatabase configuration hardening

[basid-irk]

Current defaults for SecurityDatabase in firebird.conf ({MAJOR} - 3, 4 or 5):

#SecurityDatabase = $(dir_secDb)/security{MAJOR}.fdb

in databases.conf ({SmalNumber} - 50 in Firebird 3, 256 in Firebird 4 and newer):

security.db = $(dir_secDb)/security3.fdb
{
	RemoteAccess = false
	DefaultDbCachePages = {SmalNumber}
}

Default from firebird.conf discloses information about path of server security database even at DatabaseAccess = None.

Possible solution and proposed defaults for all supported Firebird versions:

#firebird.conf
SecurityDatabase = security.db

#databases.conf
security.db = $(dir_secDb)/security{MAJOR}.fdb
{
  SecurityDatabase = security.db
  RemoteAccess = false
  DefaultDbCachePages = 256
  LockHashSlots = 8191
  LockMemSize = 1M
}

[mrotteveel]

Exactly how does it disclose information about the path, and how does your solution address it?

[basid-irk]

Select from mon$database via xnet connection on windows or ESoE "from #9056".
For proposed solution, at DatabaseAccess=None, mon$database.mon$database_name will return only alias for server security database.

[mrotteveel]

Please be more explicit and complete in describing what you mean. In any case, I don't see the problem with this, and it sounds more like security theater than providing any real security benefits.