## Registering Firewall Group Profiles 

MySQL Enterprise Firewall supports registration of group profiles as of MySQL 8.0.23. A group profile can have multiple accounts as its members. To use a firewall group profile to protect MySQL against incoming statements from a given account, follow these steps: 

1. Register the group profile and put it in RECORDING  mode. 

2. Add a member account to the group profile. 

3. Connect to the MySQL server using the member account and execute statements to be learned. This trains the group profile and establishes the rules that form the profile allowlist. 

4. Add to the group profile any other accounts that are to be group members. 

5. Switch the group profile to PROTECTING  mode. When a client connects to the server using any account that is a member of the group profile, the profile allowlist restricts statement execution. 

6. Should additional training be necessary, switch the group profile to RECORDING  mode again, update its allowlist with new statement patterns, then switch it back to PROTECTING  mode. 

Observe these guidelines for firewall-related account references: 

•Take note of the context in which account references occur. To name an account for firewall operations, specify it as a single quoted string ( ’ user_name @ host_name ’ ). This differs from the usual MySQL convention for statements such as CREATE USER  and GRANT , for which you quote the user and host parts of an account name separately ( ’ user_name ’@’ host_name ’ ). 

The requirement for naming accounts as a single quoted string for firewall operations means that you cannot use accounts that have embedded @  characters in the user name. 

•The firewall assesses statements against accounts represented by actual user and host names as authenticated by the server. When registering accounts in profiles, do not use wildcard characters or netmasks: 

•Suppose that an account named me@%.example.org  exists and a client uses it to connect to the server from the host abc.example.org . 

•The account name contains a %  wildcard character, but the server authenticates the client as having a user name of me  and host name of abc.example.com , and that is what the firewall sees. 

•Consequently, the account name to use for firewall operations is me@abc.example.org  rather than me@%.example.org . 

The following procedure shows how to register a group profile with the firewall, train the firewall to know the acceptable statements for that profile (its allowlist), use the profile to protect MySQL against execution of unacceptable statements, and add and remove group members. The example uses a group profile name of fwgrp . The example profile is presumed for use by clients of an application that accesses tables in the sakila  database (available at https://dev.mysql.com/doc/index-other.html). 

Use an administrative MySQL account to perform the steps in this procedure, except those steps designated for execution by member accounts of the firewall group profile. For statements executed by member accounts, the default database should be sakila . (You can use a different database by adjusting the instructions accordingly.) 

1. If necessary, create the accounts that are to be members of the fwgrp  group profile and grant them appropriate access privileges. Statements for one member are shown here (choose an appropriate password): 

