9. Test the group profile against the firewall by using any account in the group to execute some acceptable and unacceptable statements. The firewall matches each statement from the account against the profile allowlist and accepts or rejects it: 

•This statement is not identical to a training statement but produces the same normalized statement as one of them, so the firewall accepts it: 

mysql> SELECT title, release_year FROM film WHERE film_id = 98; +-------------------+--------------+ | title | release_year | +-------------------+--------------+ | BRIGHT ENCOUNTERS | 2006 | +-------------------+--------------+ 

•These statements match nothing in the allowlist, so the firewall rejects each with an error: 

mysql> SELECT title, release_year FROM film WHERE film_id = 98 OR TRUE; ERROR 1045 (28000): Statement was blocked by Firewall mysql> SHOW TABLES LIKE ’customer%’; ERROR 1045 (28000): Statement was blocked by Firewall mysql> TRUNCATE TABLE mysql.slow_log; ERROR 1045 (28000): Statement was blocked by Firewall 

•If the mysql_firewall_trace  system variable is enabled, the firewall also writes rejected statements to the error log. For example: 

[Note] Plugin MYSQL_FIREWALL reported: ’ACCESS DENIED for ’member1@localhost’. Reason: No match in allowlist. Statement: TRUNCATE TABLE ‘mysql‘ . ‘slow_log‘’ 

These log messages may be helpful in identifying the source of attacks, should that be necessary. 

10. Should members need to be removed from the group profile, use the sp_firewall_group_delist()  stored procedure rather than sp_firewall_group_enlist() : 

CALL mysql.sp_firewall_group_delist(’fwgrp’, ’member3@localhost’); 

The firewall group profile now is trained for member accounts. When clients connect using any account in the group and attempt to execute statements, the profile protects MySQL against statements not matched by the profile allowlist. 

The procedure just shown added only one member to the group profile before training its allowlist. Doing so provides better control over the training period by limiting which accounts can add new acceptable statements to the allowlist. Should additional training be necessary, you can switch the profile back to RECORDING  mode: 

CALL mysql.sp_set_firewall_group_mode(’fwgrp’, ’RECORDING’); 

However, that enables any member of the group to execute statements and add them to the allowlist. To limit the additional training to a single group member, call sp_set_firewall_group_mode_and_user() , which is like sp_set_firewall_group_mode()  but takes one more argument specifying which account is permitted to train the profile in RECORDING  mode. For example, to enable training only by member4@localhost , do this: 

CALL mysql.sp_set_firewall_group_mode_and_user(’fwgrp’, ’RECORDING’, ’member4@localhost’); 

That enables additional training by the specified account without having to remove the other group members. They can execute statements, but the statements are not added to the allowlist. (Remember, however, that in RECORDING  mode the other members can execute any  statement.) 

