MySQL Enterprise Firewall Registering Firewall Group Profiles MySQL Enterprise Firewall supports registration of group profiles as of MySQL 8.0.23. A group profile can have multiple accounts as its members. To use a firewall group profile to protect MySQL against incoming statements from a given account, follow these steps: 2. Add a member account to the group profile. 3. Connect to the MySQL server using the member account and execute statements to be learned. This trains the group profile and establishes the rules that form the profile allowlist. 1. Register the group profile and put it in  RECORDING  mode. 4. Add to the group profile any other accounts that are to be group members. 5. Switch the group profile to  PROTECTING  mode. When a client connects to the server using any account that is a member of the group profile, the profile allowlist restricts statement execution. 6. Should additional training be necessary, switch the group profile to  RECORDING  mode again, update its allowlist with new statement patterns, then switch it back to  PROTECTING  mode. •Take note of the context in which account references occur. To name an account for firewall operations, specify it as a single quoted string ( ’ user_name @ host_name ’ ). This differs from the usual MySQL convention for statements such as  CREATE USER  and  GRANT , for which you quote the user and host parts of an account name separately ( ’ user_name ’@’ host_name ’ ). •The firewall assesses statements against accounts represented by actual user and host names as authenticated by the server. When registering accounts in profiles, do not use wildcard characters or netmasks: •Suppose that an account named  me@%.example.org  exists and a client uses it to connect to the server from the host  abc.example.org . •The account name contains a  %  wildcard character, but the server authenticates the client as having a user name of  me  and host name of  abc.example.com , and that is what the firewall sees. •Consequently, the account name to use for firewall operations is  me@abc.example.org  rather than me@%.example.org . Observe these guidelines for firewall-related account references: The requirement for naming accounts as a single quoted string for firewall operations means that you cannot use accounts that have embedded  @  characters in the user name. The following procedure shows how to register a group profile with the firewall, train the firewall to know the acceptable statements for that profile (its allowlist), use the profile to protect MySQL against execution of unacceptable statements, and add and remove group members. The example uses a group profile name of  fwgrp . The example profile is presumed for use by clients of an application that accesses tables in the sakila  database (available at https://dev.mysql.com/doc/index-other.html). Use an administrative MySQL account to perform the steps in this procedure, except those steps designated for execution by member accounts of the firewall group profile. For statements executed by member accounts, the default database should be  sakila . (You can use a different database by adjusting the instructions accordingly.) 1. If necessary, create the accounts that are to be members of the  fwgrp  group profile and grant them appropriate access privileges. Statements for one member are shown here (choose an appropriate password): 1555