<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="firewall-usage">
      </a>
      8.4.7.3 Using MySQL Enterprise Firewall
     </h4>
    </div>
   </div>
  </div>
  <a class="indexterm" name="idm46045234526736">
  </a>
  <p>
   Before using MySQL Enterprise Firewall, install it according to the instructions
        provided in
   <a class="xref" href="firewall-installation.html" title="8.4.7.2 Installing or Uninstalling MySQL Enterprise Firewall">
    Section 8.4.7.2, “Installing or Uninstalling MySQL Enterprise Firewall”
   </a>
   .
  </p>
  <p>
   This section describes how to configure MySQL Enterprise Firewall using SQL
        statements. Alternatively, MySQL Workbench 6.3.4 or higher provides
        a graphical interface for firewall control. See
   <a class="ulink" href="/doc/workbench/en/wb-mysql-firewall.html" target="_top">
    MySQL Enterprise Firewall Interface
   </a>
   .
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      <a class="xref" href="firewall-usage.html#firewall-enabling-disabling" title="Enabling or Disabling the Firewall">
       Enabling or Disabling the Firewall
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="firewall-usage.html#firewall-schedule-reloads" title="Scheduling Firewall Cache Reloads">
       Scheduling Firewall Cache Reloads
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="firewall-usage.html#firewall-privileges" title="Assigning Firewall Privileges">
       Assigning Firewall Privileges
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="firewall-usage.html#firewall-concepts" title="Firewall Concepts">
       Firewall Concepts
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="firewall-usage.html#firewall-group-profiles" title="Registering Firewall Group Profiles">
       Registering Firewall Group Profiles
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="firewall-usage.html#firewall-account-profiles" title="Registering Firewall Account Profiles">
       Registering Firewall Account Profiles
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="firewall-usage.html#firewall-monitoring" title="Monitoring the Firewall">
       Monitoring the Firewall
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="firewall-usage.html#firewall-account-profile-migration" title="Migrating Account Profiles to Group Profiles">
       Migrating Account Profiles to Group Profiles
      </a>
     </p>
    </li>
   </ul>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="firewall-enabling-disabling">
       </a>
       Enabling or Disabling the Firewall
      </h5>
     </div>
    </div>
   </div>
   <p>
    To enable or disable the firewall, set the
    <a class="link" href="firewall-reference.html#sysvar_mysql_firewall_mode">
     <code class="literal">
      mysql_firewall_mode
     </code>
    </a>
    system
          variable. By default, this variable is enabled when the
          firewall is installed. To control the initial firewall state
          explicitly, you can set the variable at server startup. For
          example, to enable the firewall in an option file, use these
          lines:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-ini"><div class="docs-select-all right" id="sa17910707"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini"><span class="token selector">[mysqld]</span>
<span class="token constant">mysql_firewall_mode</span><span class="token attr-value"><span class="token punctuation">=</span>ON</span></code></pre>
   </div>
   <p>
    After modifying
    <code class="filename">
     my.cnf
    </code>
    , restart the
          server to cause the new setting to take effect.
   </p>
   <p>
    Alternatively, to set and persist the firewall setting at
          runtime:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa8880229"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SET</span> <span class="token keyword">PERSIST</span> mysql_firewall_mode <span class="token operator">=</span> <span class="token keyword">OFF</span><span class="token punctuation">;</span>
<span class="token keyword">SET</span> <span class="token keyword">PERSIST</span> mysql_firewall_mode <span class="token operator">=</span> <span class="token keyword">ON</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    <a class="link" href="set-variable.html" title="15.7.6.1 SET Syntax for Variable Assignment">
     <code class="literal">
      SET
          PERSIST
     </code>
    </a>
    sets a value for the running MySQL instance.
          It also saves the value, causing it to carry over to
          subsequent server restarts. To change a value for the running
          MySQL instance without having it carry over to subsequent
          restarts, use the
    <code class="literal">
     GLOBAL
    </code>
    keyword rather
          than
    <code class="literal">
     PERSIST
    </code>
    . See
    <a class="xref" href="set-variable.html" title="15.7.6.1 SET Syntax for Variable Assignment">
     Section 15.7.6.1, “SET Syntax for Variable Assignment”
    </a>
    .
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="firewall-schedule-reloads">
       </a>
       Scheduling Firewall Cache Reloads
      </h5>
     </div>
    </div>
   </div>
   <p>
    Each time the
    <code class="literal">
     MYSQL_FIREWALL
    </code>
    server-side
          plugin initializes, it loads data from these tables to its
          internal cache:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        firewall_whitelist
       </code>
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        firewall_group_allowlist
       </code>
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        firewall_users
       </code>
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        firewall_groups
       </code>
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        firewall_membership
       </code>
      </p>
     </li>
    </ul>
   </div>
   <p>
    Without restarting the server or reinstalling the server-side
          plugin, modification of data outside of the plugin is not
          reflected internally. The
    <a class="link" href="firewall-reference.html#sysvar_mysql_firewall_reload_interval_seconds">
     <code class="literal">
      mysql_firewall_reload_interval_seconds
     </code>
    </a>
    system variable makes it possible to force memory cache
          reloads from tables at specified intervals. By default, the
          periodic interval value is set to zero, which disables
          reloads.
   </p>
   <p>
    To schedule regular cache reloads, first ensure that the
    <code class="literal">
     scheduler
    </code>
    component is installed and
          enabled (see
    <a class="xref" href="scheduler-component.html" title="7.5.5 Scheduler Component">
     Section 7.5.5, “Scheduler Component”
    </a>
    ). To check
          the status of the component:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa78135240"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SHOW</span> <span class="token keyword">VARIABLES</span> <span class="token operator">LIKE</span> <span class="token string">'component_scheduler%'</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> Variable_name               <span class="token punctuation">|</span> Value <span class="token punctuation">|</span></span>
<span class="token operator">+</span><span class="token comment" spellcheck="true">-----------------------------+-------|</span>
<span class="token output"><span class="token punctuation">|</span> component_scheduler.enabled <span class="token punctuation">|</span> On    <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span></code></pre>
   </div>
   <p>
    With the firewall installed, set the
    <a class="link" href="firewall-reference.html#sysvar_mysql_firewall_reload_interval_seconds">
     <code class="literal">
      mysql_firewall_reload_interval_seconds
     </code>
    </a>
    global system variable at server startup to a number between
          60 and the INT_MAX macro value of the platform hosting the
          server. Values between zero and 60 (1 through 59) reset to 60.
          For example:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa14313102"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">mysqld</span> <span class="token punctuation"></span><em class="replaceable"><span class="token punctuation">[</span>server-options<span class="token punctuation">]</span></em><span class="token punctuation"></span> <span class="token constant">--mysql-firewall-reload-interval-seconds</span><span class="token attr-value"><span class="token punctuation">=</span>40</span>
<span class="token punctuation">.</span><span class="token punctuation">.</span><span class="token punctuation">.</span>
2023-08-31T17<span class="token punctuation">:</span>46<span class="token punctuation">:</span>35<span class="token punctuation">.</span>043468Z 0 <span class="token punctuation">[</span>Warning<span class="token punctuation">]</span> <span class="token punctuation">[</span>MY-015031<span class="token punctuation">]</span> <span class="token punctuation">[</span>Server<span class="token punctuation">]</span> Plugin MYSQL_FIREWALL 
reported<span class="token punctuation">:</span> 'Invalid reload interval specified<span class="token punctuation">:</span> 40<span class="token punctuation">.</span> Valid values are 0 <span class="token punctuation">(</span>off<span class="token punctuation">)</span> or 
greater than or equal to 60<span class="token punctuation">.</span> Adjusting to 60<span class="token punctuation">.</span>'
<span class="token punctuation">.</span><span class="token punctuation">.</span><span class="token punctuation">.</span></code></pre>
   </div>
   <p>
    Alternatively, to set and persist the firewall setting at
          startup, precede the read-only variable name by the
    <code class="literal">
     PERSIST_ONLY
    </code>
    keyword or the
    <code class="literal">
     @@PERSIST_ONLY.
    </code>
    qualifier:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa30043133"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SET</span> <span class="token keyword">PERSIST_ONLY</span> mysql_firewall_reload_interval_seconds <span class="token operator">=</span> <span class="token number">120</span><span class="token punctuation">;</span>
<span class="token keyword">SET</span> <span class="token variable">@@PERSIST_ONLY.mysql_firewall_reload_interval_seconds</span> <span class="token operator">=</span> <span class="token number">120</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    After modifying the variable, restart the server to cause the
          new setting to take effect.
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="firewall-privileges">
       </a>
       Assigning Firewall Privileges
      </h5>
     </div>
    </div>
   </div>
   <p>
    With the firewall installed, grant the appropriate privileges
          to the MySQL account or accounts to be used for administering
          it. The privileges depend on which firewall operations an
          account should be permitted to perform:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       Grant the
       <a class="link" href="privileges-provided.html#priv_firewall-exempt">
        <code class="literal">
         FIREWALL_EXEMPT
        </code>
       </a>
       privilege to any account that should be exempt from
              firewall restrictions. This is useful, for example, for a
              database administrator who configures the firewall, to
              avoid the possibility of a misconfiguration causing even
              the administrator to be locked out and unable to execute
              statements.
      </p>
     </li>
     <li class="listitem">
      <p>
       Grant the
       <a class="link" href="privileges-provided.html#priv_firewall-admin">
        <code class="literal">
         FIREWALL_ADMIN
        </code>
       </a>
       privilege to any account that should have full
              administrative firewall access. (Some administrative
              firewall functions can be invoked by accounts that have
       <a class="link" href="privileges-provided.html#priv_firewall-admin">
        <code class="literal">
         FIREWALL_ADMIN
        </code>
       </a>
       <span class="emphasis">
        <em>
         or
        </em>
       </span>
       the deprecated
       <a class="link" href="privileges-provided.html#priv_super">
        <code class="literal">
         SUPER
        </code>
       </a>
       privilege, as
              indicated in the individual function descriptions.)
      </p>
     </li>
     <li class="listitem">
      <p>
       Grant the
       <a class="link" href="privileges-provided.html#priv_firewall-user">
        <code class="literal">
         FIREWALL_USER
        </code>
       </a>
       privilege to any account that should have administrative
              access only for its own firewall rules.
      </p>
     </li>
     <li class="listitem">
      <p>
       Grant the
       <a class="link" href="privileges-provided.html#priv_execute">
        <code class="literal">
         EXECUTE
        </code>
       </a>
       privilege
              for the firewall stored procedures in the firewall
              database. These may invoke administrative functions, so
              stored procedure access also requires the privileges
              indicated earlier that are needed for those functions. The
              firewall database can be the
       <code class="literal">
        mysql
       </code>
       system database or a custom schema (see
       <a class="xref" href="firewall-installation.html#firewall-install" title="Installing MySQL Enterprise Firewall">
        Installing MySQL Enterprise Firewall
       </a>
       ).
      </p>
     </li>
    </ul>
   </div>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     The
     <a class="link" href="privileges-provided.html#priv_firewall-exempt">
      <code class="literal">
       FIREWALL_EXEMPT
      </code>
     </a>
     ,
     <a class="link" href="privileges-provided.html#priv_firewall-admin">
      <code class="literal">
       FIREWALL_ADMIN
      </code>
     </a>
     , and
     <a class="link" href="privileges-provided.html#priv_firewall-user">
      <code class="literal">
       FIREWALL_USER
      </code>
     </a>
     privileges can
            be granted only while the firewall is installed because the
     <code class="literal">
      MYSQL_FIREWALL
     </code>
     plugin defines those
            privileges.
    </p>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="firewall-concepts">
       </a>
       Firewall Concepts
      </h5>
     </div>
    </div>
   </div>
   <p>
    The MySQL server permits clients to connect and receives from
          them SQL statements to be executed. If the firewall is
          enabled, the server passes to it each incoming statement that
          does not immediately fail with a syntax error. Based on
          whether the firewall accepts the statement, the server
          executes it or returns an error to the client. This section
          describes how the firewall accomplishes the task of accepting
          or rejecting statements.
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <a class="xref" href="firewall-usage.html#firewall-profiles" title="Firewall Profiles">
        Firewall Profiles
       </a>
      </p>
     </li>
     <li class="listitem">
      <p>
       <a class="xref" href="firewall-usage.html#firewall-statement-matching" title="Firewall Statement Matching">
        Firewall Statement Matching
       </a>
      </p>
     </li>
     <li class="listitem">
      <p>
       <a class="xref" href="firewall-usage.html#firewall-profile-modes" title="Profile Operational Modes">
        Profile Operational Modes
       </a>
      </p>
     </li>
     <li class="listitem">
      <p>
       <a class="xref" href="firewall-usage.html#firewall-multiple-profiles" title="Firewall Statement Handling When Multiple Profiles Apply">
        Firewall Statement Handling When Multiple Profiles Apply
       </a>
      </p>
     </li>
    </ul>
   </div>
   <h6>
    <a name="firewall-profiles">
    </a>
    Firewall Profiles
   </h6>
   <p>
    The firewall uses a registry of profiles that determine
          whether to permit statement execution. Profiles have these
          attributes:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       An allowlist. The allowlist is the set of rules that
              defines which statements are acceptable to the profile.
      </p>
     </li>
     <li class="listitem">
      <p>
       A current operational mode. The mode enables the profile
              to be used in different ways. For example: the profile can
              be placed in training mode to establish the allowlist; the
              allowlist can be used for restricting statement execution
              or intrusion detection; the profile can be disabled
              entirely.
      </p>
     </li>
     <li class="listitem">
      <p>
       A scope of applicability. The scope indicates which client
              connections the profile applies to:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          The firewall supports account-based profiles such that
                  each profile matches a particular client account
                  (client user name and host name combination). For
                  example, you can register one account profile for
                  which the allowlist applies to connections originating
                  from
          <code class="literal">
           admin@localhost
          </code>
          and another
                  account profile for which the allowlist applies to
                  connections originating from
          <code class="literal">
           myapp@apphost.example.com
          </code>
          .
         </p>
        </li>
        <li class="listitem">
         <p>
          The firewall supports group profiles that can have
                  multiple accounts as members, with the profile
                  allowlist applying equally to all members. Group
                  profiles enable easier administration and greater
                  flexibility for deployments that require applying a
                  given set of allowlist rules to multiple accounts.
         </p>
        </li>
       </ul>
      </div>
     </li>
    </ul>
   </div>
   <p>
    Initially, no profiles exist, so by default, the firewall
          accepts all statements and has no effect on which statements
          MySQL accounts can execute. To apply firewall protective
          capabilities, explicit action is required:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       Register one or more profiles with the firewall.
      </p>
     </li>
     <li class="listitem">
      <p>
       Train the firewall by establishing the allowlist for each
              profile; that is, the types of statements the profile
              permits clients to execute.
      </p>
     </li>
     <li class="listitem">
      <p>
       Place the trained profiles in protecting mode to harden
              MySQL against unauthorized statement execution:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          MySQL associates each client session with a specific
                  user name and host name combination. This combination
                  is the
          <span class="emphasis">
           <em>
            session account
           </em>
          </span>
          .
         </p>
        </li>
        <li class="listitem">
         <p>
          For each client connection, the firewall uses the
                  session account to determine which profiles apply to
                  handling incoming statements from the client.
         </p>
         <p>
          The firewall accepts only statements permitted by the
                  applicable profile allowlists.
         </p>
        </li>
       </ul>
      </div>
     </li>
    </ul>
   </div>
   <p>
    Most firewall principles apply identically to group profiles
          and account profiles. The two types of profiles differ in
          these respects:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       An account profile allowlist applies only to a single
              account. A group profile allowlist applies when the
              session account matches any account that is a member of
              the group.
      </p>
     </li>
     <li class="listitem">
      <p>
       To apply an allowlist to multiple accounts using account
              profiles, it is necessary to register one profile per
              account and duplicate the allowlist across each profile.
              This entails training each account profile individually
              because each one must be trained using the single account
              to which it applies.
      </p>
      <p>
       A group profile allowlist applies to multiple accounts,
              with no need to duplicate it for each account. A group
              profile can be trained using any or all of the group
              member accounts, or training can be limited to any single
              member. Either way, the allowlist applies to all members.
      </p>
     </li>
     <li class="listitem">
      <p>
       Account profile names are based on specific user name and
              host name combinations that depend on which clients
              connect to the MySQL server. Group profile names are
              chosen by the firewall administrator with no constraints
              other than that their length must be from 1 to 288
              characters.
      </p>
     </li>
    </ul>
   </div>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     Due to the advantages of group profiles over account
            profiles, and because a group profile with a single member
            account is logically equivalent to an account profile for
            that account, it is recommended that all new firewall
            profiles be created as group profiles. Account profiles are
            deprecated, and subject to removal in a future MySQL
            version. For assistance converting existing account
            profiles, see
     <a class="xref" href="firewall-usage.html#firewall-account-profile-migration" title="Migrating Account Profiles to Group Profiles">
      Migrating Account Profiles to Group Profiles
     </a>
     .
    </p>
   </div>
   <p>
    The profile-based protection afforded by the firewall enables
          implementation of strategies such as these:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       If an application has unique protection requirements,
              configure it to use an account not used for any other
              purpose and set up a group profile or account profile for
              that account.
      </p>
     </li>
     <li class="listitem">
      <p>
       If related applications share protection requirements,
              associate each application with its own account, then add
              these application accounts as members of the same group
              profile. Alternatively, configure all the applications to
              use the same account and associate them with an account
              profile for that account.
      </p>
     </li>
    </ul>
   </div>
   <h6>
    <a name="firewall-statement-matching">
    </a>
    Firewall Statement Matching
   </h6>
   <p>
    Statement matching performed by the firewall does not use SQL
          statements as received from clients. Instead, the server
          converts incoming statements to normalized digest form and
          firewall operation uses these digests. The benefit of
          statement normalization is that it enables similar statements
          to be grouped and recognized using a single pattern. For
          example, these statements are distinct from each other:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa66737244"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> first_name<span class="token punctuation">,</span> last_name <span class="token keyword">FROM</span> customer <span class="token keyword">WHERE</span> customer_id <span class="token operator">=</span> <span class="token number">1</span><span class="token punctuation">;</span>
<span class="token keyword">select</span> first_name<span class="token punctuation">,</span> last_name <span class="token keyword">from</span> customer <span class="token keyword">where</span> customer_id <span class="token operator">=</span> <span class="token number">99</span><span class="token punctuation">;</span>
<span class="token keyword">SELECT</span> first_name<span class="token punctuation">,</span> last_name <span class="token keyword">FROM</span> customer <span class="token keyword">WHERE</span> customer_id <span class="token operator">=</span> <span class="token number">143</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    But all of them have the same normalized digest form:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa35684905"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> <span class="token punctuation">`</span>first_name<span class="token punctuation">`</span> <span class="token punctuation">,</span> <span class="token punctuation">`</span>last_name<span class="token punctuation">`</span> <span class="token keyword">FROM</span> <span class="token punctuation">`</span>customer<span class="token punctuation">`</span> <span class="token keyword">WHERE</span> <span class="token punctuation">`</span>customer_id<span class="token punctuation">`</span> <span class="token operator">=</span> ?</code></pre>
   </div>
   <p>
    By using normalization, firewall allowlists can store digests
          that each match many different statements received from
          clients. For more information about normalization and digests,
          see
    <a class="xref" href="performance-schema-statement-digests.html" title="29.10 Performance Schema Statement Digests and Sampling">
     Section 29.10, “Performance Schema Statement Digests and Sampling”
    </a>
    .
   </p>
   <div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Warning
    </div>
    <p>
     Setting the
     <a class="link" href="server-system-variables.html#sysvar_max_digest_length">
      <code class="literal">
       max_digest_length
      </code>
     </a>
     system
            variable to zero disables digest production, which also
            disables server functionality that requires digests, such as
            MySQL Enterprise Firewall.
    </p>
   </div>
   <h6>
    <a name="firewall-profile-modes">
    </a>
    Profile Operational Modes
   </h6>
   <p>
    Each profile registered with the firewall has its own
          operational mode, chosen from these values:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        OFF
       </code>
       : This mode disables the profile.
              The firewall considers it inactive and ignores it.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        RECORDING
       </code>
       : This is the firewall
              training mode. Incoming statements received from a client
              that matches the profile are considered acceptable for the
              profile and become part of its
       <span class="quote">
        “
        <span class="quote">
         fingerprint.
        </span>
        ”
       </span>
       The firewall records the normalized digest form of each
              statement to learn the acceptable statement patterns for
              the profile. Each pattern is a rule, and the union of the
              rules is the profile allowlist.
      </p>
      <p>
       A difference between group and account profiles is that
              statement recording for a group profile can be limited to
              statements received from a single group member (the
              training member).
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        PROTECTING
       </code>
       : In this mode, the profile
              allows or prevents statement execution. The firewall
              matches incoming statements against the profile allowlist,
              accepting only statements that match and rejecting those
              that do not. After training a profile in
       <code class="literal">
        RECORDING
       </code>
       mode, switch it to
       <code class="literal">
        PROTECTING
       </code>
       mode to harden MySQL against
              access by statements that deviate from the allowlist. If
              the
       <a class="link" href="firewall-reference.html#sysvar_mysql_firewall_trace">
        <code class="literal">
         mysql_firewall_trace
        </code>
       </a>
       system variable is enabled, the firewall also writes
              rejected statements to the error log.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        DETECTING
       </code>
       : This mode detects but not
              does not block intrusions (statements that are suspicious
              because they match nothing in the profile allowlist). In
       <code class="literal">
        DETECTING
       </code>
       mode, the firewall writes
              suspicious statements to the error log but accepts them
              without denying access.
      </p>
     </li>
    </ul>
   </div>
   <p>
    When a profile is assigned any of the preceding mode values,
          the firewall stores the mode in the profile. Firewall
          mode-setting operations also permit a mode value of
    <code class="literal">
     RESET
    </code>
    , but this value is not stored:
          setting a profile to
    <code class="literal">
     RESET
    </code>
    mode causes the
          firewall to delete all rules for the profile and set its mode
          to
    <code class="literal">
     OFF
    </code>
    .
   </p>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     Messages written to the error log in
     <code class="literal">
      DETECTING
     </code>
     mode or because
     <a class="link" href="firewall-reference.html#sysvar_mysql_firewall_trace">
      <code class="literal">
       mysql_firewall_trace
      </code>
     </a>
     is
            enabled are written as Notes, which are information
            messages. To ensure that such messages appear in the error
            log and are not discarded, make sure that error-logging
            verbosity is sufficient to include information messages. For
            example, if you are using priority-based log filtering, as
            described in
     <a class="xref" href="error-log-priority-based-filtering.html" title="7.4.2.5 Priority-Based Error Log Filtering (log_filter_internal)">
      Section 7.4.2.5, “Priority-Based Error Log Filtering (log_filter_internal)”
     </a>
     , set
            the
     <a class="link" href="server-system-variables.html#sysvar_log_error_verbosity">
      <code class="literal">
       log_error_verbosity
      </code>
     </a>
     system variable to a value of 3.
    </p>
   </div>
   <h6>
    <a name="firewall-multiple-profiles">
    </a>
    Firewall Statement Handling When Multiple Profiles Apply
   </h6>
   <p>
    For simplicity, later sections that describe how to set up
          profiles take the perspective that the firewall matches
          incoming statements from a client against only a single
          profile, either a group profile or account profile. But
          firewall operation can be more complex:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       A group profile can include multiple accounts as members.
      </p>
     </li>
     <li class="listitem">
      <p>
       An account can be a member of multiple group profiles.
      </p>
     </li>
     <li class="listitem">
      <p>
       Multiple profiles can match a given client.
      </p>
     </li>
    </ul>
   </div>
   <p>
    The following description covers the general case of how the
          firewall operates, when potentially multiple profiles apply to
          incoming statements.
   </p>
   <p>
    As previously mentioned, MySQL associates each client session
          with a specific user name and host name combination known as
          the
    <span class="emphasis">
     <em>
      session account
     </em>
    </span>
    . The firewall matches
          the session account against registered profiles to determine
          which profiles apply to handling incoming statements from the
          session:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       The firewall ignores inactive profiles (profiles with a
              mode of
       <code class="literal">
        OFF
       </code>
       ).
      </p>
     </li>
     <li class="listitem">
      <p>
       The session account matches every active group profile
              that includes a member having the same user and host.
              There can be more than one such group profile.
      </p>
     </li>
     <li class="listitem">
      <p>
       The session account matches an active account profile
              having the same user and host, if there is one. There is
              at most one such account profile.
      </p>
     </li>
    </ul>
   </div>
   <p>
    In other words, the session account can match 0 or more active
          group profiles, and 0 or 1 active account profiles. This means
          that 0, 1, or multiple firewall profiles are applicable to a
          given session, for which the firewall handles each incoming
          statement as follows:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       If there is no applicable profile, the firewall imposes no
              restrictions and accepts the statement.
      </p>
     </li>
     <li class="listitem">
      <p>
       If there are applicable profiles, their modes determine
              statement handling:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          The firewall records the statement in the allowlist of
                  each applicable profile that is in
          <code class="literal">
           RECORDING
          </code>
          mode.
         </p>
        </li>
        <li class="listitem">
         <p>
          The firewall writes the statement to the error log for
                  each applicable profile in
          <code class="literal">
           DETECTING
          </code>
          mode for which the
                  statement is suspicious (does not match the profile
                  allowlist).
         </p>
        </li>
        <li class="listitem">
         <p>
          The firewall accepts the statement if at least one
                  applicable profile is in
          <code class="literal">
           RECORDING
          </code>
          or
          <code class="literal">
           DETECTING
          </code>
          mode (those modes
                  accept all statements), or if the statement matches
                  the allowlist of at least one applicable profile in
          <code class="literal">
           PROTECTING
          </code>
          mode. Otherwise, the
                  firewall rejects the statement (and writes it to the
                  error log if the
          <a class="link" href="firewall-reference.html#sysvar_mysql_firewall_trace">
           <code class="literal">
            mysql_firewall_trace
           </code>
          </a>
          system variable is enabled).
         </p>
        </li>
       </ul>
      </div>
     </li>
    </ul>
   </div>
   <p>
    With that description in mind, the next sections revert to the
          simplicity of the situations when a single group profile or a
          single account profile apply, and cover how to set up each
          type of profile.
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="firewall-group-profiles">
       </a>
       Registering Firewall Group Profiles
      </h5>
     </div>
    </div>
   </div>
   <p>
    MySQL Enterprise Firewall supports registration of group profiles. A group
          profile can have multiple accounts as its members. To use a
          firewall group profile to protect MySQL against incoming
          statements from a given account, follow these steps:
   </p>
   <div class="orderedlist">
    <ol class="orderedlist" type="1">
     <li class="listitem">
      <p>
       Register the group profile and put it in
       <code class="literal">
        RECORDING
       </code>
       mode.
      </p>
     </li>
     <li class="listitem">
      <p>
       Add a member account to the group profile.
      </p>
     </li>
     <li class="listitem">
      <p>
       Connect to the MySQL server using the member account and
              execute statements to be learned. This trains the group
              profile and establishes the rules that form the profile
              allowlist.
      </p>
     </li>
     <li class="listitem">
      <p>
       Add to the group profile any other accounts that are to be
              group members.
      </p>
     </li>
     <li class="listitem">
      <p>
       Switch the group profile to
       <code class="literal">
        PROTECTING
       </code>
       mode. When a client connects to the server using any
              account that is a member of the group profile, the profile
              allowlist restricts statement execution.
      </p>
     </li>
     <li class="listitem">
      <p>
       Should additional training be necessary, switch the group
              profile to
       <code class="literal">
        RECORDING
       </code>
       mode again, update
              its allowlist with new statement patterns, then switch it
              back to
       <code class="literal">
        PROTECTING
       </code>
       mode.
      </p>
     </li>
    </ol>
   </div>
   <p>
    Observe these guidelines for firewall-related account
          references:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       Take note of the context in which account references
              occur. To name an account for firewall operations, specify
              it as a single quoted string
              (
       <code class="literal">
        '
        <em class="replaceable">
         <code>
          user_name
         </code>
        </em>
        @
        <em class="replaceable">
         <code>
          host_name
         </code>
        </em>
        '
       </code>
       ).
              This differs from the usual MySQL convention for
              statements such as
       <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
        <code class="literal">
         CREATE
              USER
        </code>
       </a>
       and
       <a class="link" href="grant.html" title="15.7.1.6 GRANT Statement">
        <code class="literal">
         GRANT
        </code>
       </a>
       ,
              for which you quote the user and host parts of an account
              name separately
              (
       <code class="literal">
        '
        <em class="replaceable">
         <code>
          user_name
         </code>
        </em>
        '@'
        <em class="replaceable">
         <code>
          host_name
         </code>
        </em>
        '
       </code>
       ).
      </p>
      <p>
       The requirement for naming accounts as a single quoted
              string for firewall operations means that you cannot use
              accounts that have embedded
       <code class="literal">
        @
       </code>
       characters in the user name.
      </p>
     </li>
     <li class="listitem">
      <p>
       The firewall assesses statements against accounts
              represented by actual user and host names as authenticated
              by the server. When registering accounts in profiles, do
              not use wildcard characters or netmasks:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          Suppose that an account named
          <code class="literal">
           me@%.example.org
          </code>
          exists and a
                  client uses it to connect to the server from the host
          <code class="literal">
           abc.example.org
          </code>
          .
         </p>
        </li>
        <li class="listitem">
         <p>
          The account name contains a
          <code class="literal">
           %
          </code>
          wildcard character, but the server authenticates the
                  client as having a user name of
          <code class="literal">
           me
          </code>
          and host name of
          <code class="literal">
           abc.example.com
          </code>
          ,
                  and that is what the firewall sees.
         </p>
        </li>
        <li class="listitem">
         <p>
          Consequently, the account name to use for firewall
                  operations is
          <code class="literal">
           me@abc.example.org
          </code>
          rather than
          <code class="literal">
           me@%.example.org
          </code>
          .
         </p>
        </li>
       </ul>
      </div>
     </li>
    </ul>
   </div>
   <p>
    The following procedure shows how to register a group profile
          with the firewall, train the firewall to know the acceptable
          statements for that profile (its allowlist), use the profile
          to protect MySQL against execution of unacceptable statements,
          and add and remove group members. The example uses a group
          profile name of
    <code class="literal">
     fwgrp
    </code>
    . The example profile
          is presumed for use by clients of an application that accesses
          tables in the
    <code class="literal">
     sakila
    </code>
    database (available at
    <a class="ulink" href="/doc/index-other.html" target="_top">
     https://dev.mysql.com/doc/index-other.html
    </a>
    ).
   </p>
   <p>
    Use an administrative MySQL account to perform the steps in
          this procedure, except those steps designated for execution by
          member accounts of the firewall group profile. For statements
          executed by member accounts, the default database should be
    <code class="literal">
     sakila
    </code>
    . (You can use a different database
          by adjusting the instructions accordingly.)
   </p>
   <div class="orderedlist">
    <ol class="orderedlist" type="1">
     <li class="listitem">
      <p>
       If necessary, create the accounts that are to be members
              of the
       <code class="literal">
        fwgrp
       </code>
       group profile and grant
              them appropriate access privileges. Statements for one
              member are shown here (choose an appropriate password):
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa49074430"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'member1'</span>@<span class="token string">'localhost'</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">password</em>'</span><span class="token punctuation">;</span>
<span class="token keyword">GRANT</span> <span class="token keyword">ALL</span> <span class="token keyword">ON</span> sakila<span class="token punctuation">.</span><span class="token operator">*</span> <span class="token keyword">TO</span> <span class="token string">'member1'</span>@<span class="token string">'localhost'</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       Use the
       <code class="literal">
        sp_set_firewall_group_mode()
       </code>
       stored procedure to register the group profile with the
              firewall and place the profile in
       <code class="literal">
        RECORDING
       </code>
       (training) mode:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa77350723"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CALL</span> mysql<span class="token punctuation">.</span>sp_set_firewall_group_mode<span class="token punctuation">(</span><span class="token string">'fwgrp'</span><span class="token punctuation">,</span> <span class="token string">'RECORDING'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
      </div>
      <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
       <div class="admon-title">
        Note
       </div>
       <p>
        If you have installed MySQL Enterprise Firewall in a custom schema, then
                make appropriate substitution for your system. For
                example, if the firewall is installed in the
        <code class="literal">
         fwdb
        </code>
        schema, then execute the stored
                procedures like this:
       </p>
       <div class="copytoclipboard-wrapper">
        <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa62237038"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CALL</span> fwdb<span class="token punctuation">.</span>sp_set_firewall_group_mode<span class="token punctuation">(</span><span class="token string">'fwgrp'</span><span class="token punctuation">,</span> <span class="token string">'RECORDING'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
       </div>
       <p>
       </p>
      </div>
     </li>
     <li class="listitem">
      <p>
       Use the
       <code class="literal">
        sp_firewall_group_enlist()
       </code>
       stored procedure to add an initial member account for use
              in training the group profile allowlist:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa18416518"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CALL</span> mysql<span class="token punctuation">.</span>sp_firewall_group_enlist<span class="token punctuation">(</span><span class="token string">'fwgrp'</span><span class="token punctuation">,</span> <span class="token string">'member1@localhost'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       To train the group profile using the initial member
              account, connect to the server as
       <code class="literal">
        member1
       </code>
       from the server host so that
              the firewall sees a session account of
       <code class="literal">
        member1@localhost
       </code>
       . Then execute some
              statements to be considered legitimate for the profile.
              For example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa16247387"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> title<span class="token punctuation">,</span> release_year <span class="token keyword">FROM</span> film <span class="token keyword">WHERE</span> film_id <span class="token operator">=</span> <span class="token number">1</span><span class="token punctuation">;</span>
<span class="token keyword">UPDATE</span> actor <span class="token keyword">SET</span> last_update <span class="token operator">=</span> <span class="token function">NOW</span><span class="token punctuation">(</span><span class="token punctuation">)</span> <span class="token keyword">WHERE</span> actor_id <span class="token operator">=</span> <span class="token number">1</span><span class="token punctuation">;</span>
<span class="token keyword">SELECT</span> store_id<span class="token punctuation">,</span> <span class="token function">COUNT</span><span class="token punctuation">(</span><span class="token operator">*</span><span class="token punctuation">)</span> <span class="token keyword">FROM</span> inventory <span class="token keyword">GROUP</span> <span class="token keyword">BY</span> store_id<span class="token punctuation">;</span></code></pre>
      </div>
      <p>
       The firewall receives the statements from the
       <code class="literal">
        member1@localhost
       </code>
       account. Because that
              account is a member of the
       <code class="literal">
        fwgrp
       </code>
       profile, which is in
       <code class="literal">
        RECORDING
       </code>
       mode,
              the firewall interprets the statements as applicable to
       <code class="literal">
        fwgrp
       </code>
       and records the normalized digest
              form of the statements as rules in the
       <code class="literal">
        fwgrp
       </code>
       allowlist. Those rules then apply
              to all accounts that are members of
       <code class="literal">
        fwgrp
       </code>
       .
      </p>
      <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
       <div class="admon-title">
        Note
       </div>
       <p>
        Until the
        <code class="literal">
         fwgrp
        </code>
        group profile
                receives statements in
        <code class="literal">
         RECORDING
        </code>
        mode, its allowlist is empty, which is equivalent to
        <span class="quote">
         “
         <span class="quote">
          deny all.
         </span>
         ”
        </span>
        No statement can match an empty
                allowlist, which has these implications:
       </p>
       <div class="itemizedlist">
        <ul class="itemizedlist" style="list-style-type: disc; ">
         <li class="listitem">
          <p>
           The group profile cannot be switched to
           <code class="literal">
            PROTECTING
           </code>
           mode. It would reject
                    every statement, effectively prohibiting the
                    accounts that are group members from executing any
                    statement.
          </p>
         </li>
         <li class="listitem">
          <p>
           The group profile can be switched to
           <code class="literal">
            DETECTING
           </code>
           mode. In this case, the
                    profile accepts every statement but logs it as
                    suspicious.
          </p>
         </li>
        </ul>
       </div>
      </div>
     </li>
     <li class="listitem">
      <p>
       At this point, the group profile information is cached,
              including its name, membership, and allowlist. To see this
              information, query the Performance Schema firewall tables:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa83459924"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> <span class="token keyword">MODE</span> <span class="token keyword">FROM</span> performance_schema<span class="token punctuation">.</span>firewall_groups
       <span class="token keyword">WHERE</span> <span class="token keyword">NAME</span> <span class="token operator">=</span> <span class="token string">'fwgrp'</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> MODE      <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> RECORDING <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> <span class="token operator">*</span> <span class="token keyword">FROM</span> performance_schema<span class="token punctuation">.</span>firewall_membership
       <span class="token keyword">WHERE</span> GROUP_ID <span class="token operator">=</span> <span class="token string">'fwgrp'</span> <span class="token keyword">ORDER</span> <span class="token keyword">BY</span> MEMBER_ID<span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> GROUP_ID <span class="token punctuation">|</span> MEMBER_ID         <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> fwgrp    <span class="token punctuation">|</span> member1@localhost <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> RULE <span class="token keyword">FROM</span> performance_schema<span class="token punctuation">.</span>firewall_group_allowlist
       <span class="token keyword">WHERE</span> <span class="token keyword">NAME</span> <span class="token operator">=</span> <span class="token string">'fwgrp'</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> RULE                                                                 <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> SELECT @@`version_comment` LIMIT ?                                   <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">|</span> UPDATE `actor` SET `last_update` = NOW ( ) WHERE `actor_id` = ?      <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">|</span> SELECT `title` , `release_year` FROM `film` WHERE `film_id` = ?      <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">|</span> SELECT `store_id` , COUNT ( * ) FROM `inventory` GROUP BY `store_id` <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span></code></pre>
      </div>
      <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
       <div class="admon-title">
        Note
       </div>
       <p>
        The
        <code class="literal">
         @@version_comment
        </code>
        rule comes from
                a statement sent automatically by the
        <a class="link" href="mysql.html" title="6.5.1 mysql — The MySQL Command-Line Client">
         <span class="command">
          <strong>
           mysql
          </strong>
         </span>
        </a>
        client when you connect to the
                server.
       </p>
      </div>
      <div class="important" style="margin-left: 0.5in; margin-right: 0.5in;">
       <div class="admon-title">
        Important
       </div>
       <p>
        Train the firewall under conditions matching application
                use. For example, to determine server characteristics
                and capabilities, a given MySQL connector might send
                statements to the server at the beginning of each
                session. If an application normally is used through that
                connector, train the firewall using the connector, too.
                That enables those initial statements to become part of
                the allowlist for the group profile associated with the
                application.
       </p>
      </div>
     </li>
     <li class="listitem">
      <p>
       Invoke
       <code class="literal">
        sp_set_firewall_group_mode()
       </code>
       again to switch the group profile to
       <code class="literal">
        PROTECTING
       </code>
       mode:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa69187228"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CALL</span> mysql<span class="token punctuation">.</span>sp_set_firewall_group_mode<span class="token punctuation">(</span><span class="token string">'fwgrp'</span><span class="token punctuation">,</span> <span class="token string">'PROTECTING'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
      </div>
      <div class="important" style="margin-left: 0.5in; margin-right: 0.5in;">
       <div class="admon-title">
        Important
       </div>
       <p>
        Switching the group profile out of
        <code class="literal">
         RECORDING
        </code>
        mode synchronizes its
                cached data to the firewall database tables that provide
                persistent underlying storage. If you do not switch the
                mode for a profile that is being recorded, the cached
                data is not written to persistent storage and is lost
                when the server is restarted. The firewall database can
                be the
        <code class="literal">
         mysql
        </code>
        system database or a
                custom schema (see
        <a class="xref" href="firewall-installation.html#firewall-install" title="Installing MySQL Enterprise Firewall">
         Installing MySQL Enterprise Firewall
        </a>
        ).
       </p>
      </div>
     </li>
     <li class="listitem">
      <p>
       Add to the group profile any other accounts that should be
              members:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa52371537"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CALL</span> mysql<span class="token punctuation">.</span>sp_firewall_group_enlist<span class="token punctuation">(</span><span class="token string">'fwgrp'</span><span class="token punctuation">,</span> <span class="token string">'member2@localhost'</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token keyword">CALL</span> mysql<span class="token punctuation">.</span>sp_firewall_group_enlist<span class="token punctuation">(</span><span class="token string">'fwgrp'</span><span class="token punctuation">,</span> <span class="token string">'member3@localhost'</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token keyword">CALL</span> mysql<span class="token punctuation">.</span>sp_firewall_group_enlist<span class="token punctuation">(</span><span class="token string">'fwgrp'</span><span class="token punctuation">,</span> <span class="token string">'member4@localhost'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
      </div>
      <p>
       The profile allowlist trained using the
       <code class="literal">
        member1@localhost
       </code>
       account now also
              applies to the additional accounts.
      </p>
     </li>
     <li class="listitem">
      <p>
       To verify the updated group membership, query the
       <code class="literal">
        firewall_membership
       </code>
       table again:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa34796565"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> <span class="token operator">*</span> <span class="token keyword">FROM</span> performance_schema<span class="token punctuation">.</span>firewall_membership
       <span class="token keyword">WHERE</span> GROUP_ID <span class="token operator">=</span> <span class="token string">'fwgrp'</span> <span class="token keyword">ORDER</span> <span class="token keyword">BY</span> MEMBER_ID<span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> GROUP_ID <span class="token punctuation">|</span> MEMBER_ID         <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> fwgrp    <span class="token punctuation">|</span> member1@localhost <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">|</span> fwgrp    <span class="token punctuation">|</span> member2@localhost <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">|</span> fwgrp    <span class="token punctuation">|</span> member3@localhost <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">|</span> fwgrp    <span class="token punctuation">|</span> member4@localhost <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       Test the group profile against the firewall by using any
              account in the group to execute some acceptable and
              unacceptable statements. The firewall matches each
              statement from the account against the profile allowlist
              and accepts or rejects it:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: disc; ">
        <li class="listitem">
         <p>
          This statement is not identical to a training
                  statement but produces the same normalized statement
                  as one of them, so the firewall accepts it:
         </p>
         <div class="copytoclipboard-wrapper">
          <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa15541196"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> title<span class="token punctuation">,</span> release_year <span class="token keyword">FROM</span> film <span class="token keyword">WHERE</span> film_id <span class="token operator">=</span> <span class="token number">98</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> title             <span class="token punctuation">|</span> release_year <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> BRIGHT ENCOUNTERS <span class="token punctuation">|</span>         2006 <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span></code></pre>
         </div>
        </li>
        <li class="listitem">
         <p>
          These statements match nothing in the allowlist, so
                  the firewall rejects each with an error:
         </p>
         <div class="copytoclipboard-wrapper">
          <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa58214140"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> title<span class="token punctuation">,</span> release_year <span class="token keyword">FROM</span> film <span class="token keyword">WHERE</span> film_id <span class="token operator">=</span> <span class="token number">98</span> <span class="token operator">OR</span> <span class="token boolean">TRUE</span><span class="token punctuation">;</span>
<span class="token output">ERROR 1045 (28000)<span class="token punctuation">:</span> Statement was blocked by Firewall</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">SHOW</span> <span class="token keyword">TABLES</span> <span class="token operator">LIKE</span> <span class="token string">'customer%'</span><span class="token punctuation">;</span>
<span class="token output">ERROR 1045 (28000)<span class="token punctuation">:</span> Statement was blocked by Firewall</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">TRUNCATE</span> <span class="token keyword">TABLE</span> mysql<span class="token punctuation">.</span>slow_log<span class="token punctuation">;</span>
<span class="token output">ERROR 1045 (28000)<span class="token punctuation">:</span> Statement was blocked by Firewall</span></code></pre>
         </div>
        </li>
        <li class="listitem">
         <p>
          If the
          <a class="link" href="firewall-reference.html#sysvar_mysql_firewall_trace">
           <code class="literal">
            mysql_firewall_trace
           </code>
          </a>
          system variable is enabled, the firewall also writes
                  rejected statements to the error log. For example:
         </p>
         <div class="copytoclipboard-wrapper">
          <pre class="programlisting language-none"><div class="docs-select-all right" id="sa52874854"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-none">[Note] Plugin MYSQL_FIREWALL reported:
'ACCESS DENIED for 'member1@localhost'. Reason: No match in allowlist.
Statement: TRUNCATE TABLE `mysql` . `slow_log`'</code></pre>
         </div>
         <p>
          These log messages may be helpful in identifying the
                  source of attacks, should that be necessary.
         </p>
        </li>
       </ul>
      </div>
     </li>
     <li class="listitem">
      <p>
       Should members need to be removed from the group profile,
              use the
       <code class="literal">
        sp_firewall_group_delist()
       </code>
       stored procedure rather than
       <code class="literal">
        sp_firewall_group_enlist()
       </code>
       :
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa12329770"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CALL</span> mysql<span class="token punctuation">.</span>sp_firewall_group_delist<span class="token punctuation">(</span><span class="token string">'fwgrp'</span><span class="token punctuation">,</span> <span class="token string">'member3@localhost'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
    </ol>
   </div>
   <p>
    The firewall group profile now is trained for member accounts.
          When clients connect using any account in the group and
          attempt to execute statements, the profile protects MySQL
          against statements not matched by the profile allowlist.
   </p>
   <p>
    The procedure just shown added only one member to the group
          profile before training its allowlist. Doing so provides
          better control over the training period by limiting which
          accounts can add new acceptable statements to the allowlist.
          Should additional training be necessary, you can switch the
          profile back to
    <code class="literal">
     RECORDING
    </code>
    mode:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa42091119"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CALL</span> mysql<span class="token punctuation">.</span>sp_set_firewall_group_mode<span class="token punctuation">(</span><span class="token string">'fwgrp'</span><span class="token punctuation">,</span> <span class="token string">'RECORDING'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    However, that enables any member of the group to execute
          statements and add them to the allowlist. To limit the
          additional training to a single group member, call
    <code class="literal">
     sp_set_firewall_group_mode_and_user()
    </code>
    ,
          which is like
    <code class="literal">
     sp_set_firewall_group_mode()
    </code>
    but takes one more argument specifying which account is
          permitted to train the profile in
    <code class="literal">
     RECORDING
    </code>
    mode. For example, to enable training only by
    <code class="literal">
     member4@localhost
    </code>
    , do this:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa78400043"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CALL</span> mysql<span class="token punctuation">.</span>sp_set_firewall_group_mode_and_user<span class="token punctuation">(</span><span class="token string">'fwgrp'</span><span class="token punctuation">,</span> <span class="token string">'RECORDING'</span><span class="token punctuation">,</span> <span class="token string">'member4@localhost'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    That enables additional training by the specified account
          without having to remove the other group members. They can
          execute statements, but the statements are not added to the
          allowlist. (Remember, however, that in
    <code class="literal">
     RECORDING
    </code>
    mode the other members can
          execute
    <span class="emphasis">
     <em>
      any
     </em>
    </span>
    statement.)
   </p>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     To avoid unexpected behavior when a particular account is
            specified as the training account for a group profile,
            always ensure that account is a member of the group.
    </p>
   </div>
   <p>
    After the additional training, set the group profile back to
    <code class="literal">
     PROTECTING
    </code>
    mode:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa29718726"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CALL</span> mysql<span class="token punctuation">.</span>sp_set_firewall_group_mode<span class="token punctuation">(</span><span class="token string">'fwgrp'</span><span class="token punctuation">,</span> <span class="token string">'PROTECTING'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    The training account established by
    <code class="literal">
     sp_set_firewall_group_mode_and_user()
    </code>
    is
          saved in the group profile, so the firewall remembers it in
          case more training is needed later. Thus, if you call
    <code class="literal">
     sp_set_firewall_group_mode()
    </code>
    (which takes
          no training account argument), the current profile training
          account,
    <code class="literal">
     member4@localhost
    </code>
    , remains
          unchanged.
   </p>
   <p>
    To clear the training account if it actually is desired to
          enable all group members to perform training in
    <code class="literal">
     RECORDING
    </code>
    mode, call
    <code class="literal">
     sp_set_firewall_group_mode_and_user()
    </code>
    and
          pass a
    <code class="literal">
     NULL
    </code>
    value for the account argument:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa99051076"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CALL</span> mysql<span class="token punctuation">.</span>sp_set_firewall_group_mode_and_user<span class="token punctuation">(</span><span class="token string">'fwgrp'</span><span class="token punctuation">,</span> <span class="token string">'RECORDING'</span><span class="token punctuation">,</span> <span class="token boolean">NULL</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    It is possible to detect intrusions by logging nonmatching
          statements as suspicious without denying access. First, put
          the group profile in
    <code class="literal">
     DETECTING
    </code>
    mode:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa59882536"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CALL</span> mysql<span class="token punctuation">.</span>sp_set_firewall_group_mode<span class="token punctuation">(</span><span class="token string">'fwgrp'</span><span class="token punctuation">,</span> <span class="token string">'DETECTING'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    Then, using a member account, execute a statement that does
          not match the group profile allowlist. In
    <code class="literal">
     DETECTING
    </code>
    mode, the firewall permits the
          nonmatching statement to execute:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa88906271"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SHOW</span> <span class="token keyword">TABLES</span> <span class="token operator">LIKE</span> <span class="token string">'customer%'</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> Tables_in_sakila (customer%) <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> customer                     <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">|</span> customer_list                <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span></code></pre>
   </div>
   <p>
    In addition, the firewall writes a message to the error log:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-none"><div class="docs-select-all right" id="sa72058198"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-none">[Note] Plugin MYSQL_FIREWALL reported:
'SUSPICIOUS STATEMENT from 'member1@localhost'. Reason: No match in allowlist.
Statement: SHOW TABLES LIKE ?'</code></pre>
   </div>
   <p>
    To disable a group profile, change its mode to
    <code class="literal">
     OFF
    </code>
    :
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa61588619"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CALL</span> mysql<span class="token punctuation">.</span>sp_set_firewall_group_mode<span class="token punctuation">(</span><span class="token keyword"><em class="replaceable">group</em></span><span class="token punctuation">,</span> <span class="token string">'OFF'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    To forget all training for a profile and disable it, reset it:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa40735559"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CALL</span> mysql<span class="token punctuation">.</span>sp_set_firewall_group_mode<span class="token punctuation">(</span><span class="token keyword"><em class="replaceable">group</em></span><span class="token punctuation">,</span> <span class="token string">'RESET'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    The reset operation causes the firewall to delete all rules
          for the profile and set its mode to
    <code class="literal">
     OFF
    </code>
    .
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="firewall-account-profiles">
       </a>
       Registering Firewall Account Profiles
      </h5>
     </div>
    </div>
   </div>
   <p>
    MySQL Enterprise Firewall enables profiles to be registered that correspond to
          individual accounts. To use a firewall account profile to
          protect MySQL against incoming statements from a given
          account, follow these steps:
   </p>
   <div class="orderedlist">
    <ol class="orderedlist" type="1">
     <li class="listitem">
      <p>
       Register the account profile and put it in
       <code class="literal">
        RECORDING
       </code>
       mode.
      </p>
     </li>
     <li class="listitem">
      <p>
       Connect to the MySQL server using the account and execute
              statements to be learned. This trains the account profile
              and establishes the rules that form the profile allowlist.
      </p>
     </li>
     <li class="listitem">
      <p>
       Switch the account profile to
       <code class="literal">
        PROTECTING
       </code>
       mode. When a client connects
              to the server using the account, the account profile
              allowlist restricts statement execution.
      </p>
     </li>
     <li class="listitem">
      <p>
       Should additional training be necessary, switch the
              account profile to
       <code class="literal">
        RECORDING
       </code>
       mode
              again, update its allowlist with new statement patterns,
              then switch it back to
       <code class="literal">
        PROTECTING
       </code>
       mode.
      </p>
     </li>
    </ol>
   </div>
   <p>
    Observe these guidelines for firewall-related account
          references:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       Take note of the context in which account references
              occur. To name an account for firewall operations, specify
              it as a single quoted string
              (
       <code class="literal">
        '
        <em class="replaceable">
         <code>
          user_name
         </code>
        </em>
        @
        <em class="replaceable">
         <code>
          host_name
         </code>
        </em>
        '
       </code>
       ).
              This differs from the usual MySQL convention for
              statements such as
       <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
        <code class="literal">
         CREATE
              USER
        </code>
       </a>
       and
       <a class="link" href="grant.html" title="15.7.1.6 GRANT Statement">
        <code class="literal">
         GRANT
        </code>
       </a>
       ,
              for which you quote the user and host parts of an account
              name separately
              (
       <code class="literal">
        '
        <em class="replaceable">
         <code>
          user_name
         </code>
        </em>
        '@'
        <em class="replaceable">
         <code>
          host_name
         </code>
        </em>
        '
       </code>
       ).
      </p>
      <p>
       The requirement for naming accounts as a single quoted
              string for firewall operations means that you cannot use
              accounts that have embedded
       <code class="literal">
        @
       </code>
       characters in the user name.
      </p>
     </li>
     <li class="listitem">
      <p>
       The firewall assesses statements against accounts
              represented by actual user and host names as authenticated
              by the server. When registering accounts in profiles, do
              not use wildcard characters or netmasks:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          Suppose that an account named
          <code class="literal">
           me@%.example.org
          </code>
          exists and a
                  client uses it to connect to the server from the host
          <code class="literal">
           abc.example.org
          </code>
          .
         </p>
        </li>
        <li class="listitem">
         <p>
          The account name contains a
          <code class="literal">
           %
          </code>
          wildcard character, but the server authenticates the
                  client as having a user name of
          <code class="literal">
           me
          </code>
          and host name of
          <code class="literal">
           abc.example.com
          </code>
          ,
                  and that is what the firewall sees.
         </p>
        </li>
        <li class="listitem">
         <p>
          Consequently, the account name to use for firewall
                  operations is
          <code class="literal">
           me@abc.example.org
          </code>
          rather than
          <code class="literal">
           me@%.example.org
          </code>
          .
         </p>
        </li>
       </ul>
      </div>
     </li>
    </ul>
   </div>
   <p>
    The following procedure shows how to register an account
          profile with the firewall, train the firewall to know the
          acceptable statements for that profile (its allowlist), and
          use the profile to protect MySQL against execution of
          unacceptable statements by the account. The example account,
    <code class="literal">
     fwuser@localhost
    </code>
    , is presumed for use by an
          application that accesses tables in the
    <code class="literal">
     sakila
    </code>
    database (available at
    <a class="ulink" href="/doc/index-other.html" target="_top">
     https://dev.mysql.com/doc/index-other.html
    </a>
    ).
   </p>
   <p>
    Use an administrative MySQL account to perform the steps in
          this procedure, except those steps designated for execution by
          the
    <code class="literal">
     fwuser@localhost
    </code>
    account that
          corresponds to the account profile registered with the
          firewall. For statements executed using this account, the
          default database should be
    <code class="literal">
     sakila
    </code>
    . (You can
          use a different database by adjusting the instructions
          accordingly.)
   </p>
   <div class="orderedlist">
    <ol class="orderedlist" type="1">
     <li class="listitem">
      <p>
       If necessary, create the account to use for executing
              statements (choose an appropriate password) and grant it
              privileges for the
       <code class="literal">
        sakila
       </code>
       database:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa61395829"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'fwuser'</span>@<span class="token string">'localhost'</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">password</em>'</span><span class="token punctuation">;</span>
<span class="token keyword">GRANT</span> <span class="token keyword">ALL</span> <span class="token keyword">ON</span> sakila<span class="token punctuation">.</span><span class="token operator">*</span> <span class="token keyword">TO</span> <span class="token string">'fwuser'</span>@<span class="token string">'localhost'</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       Use the
       <code class="literal">
        sp_set_firewall_mode()
       </code>
       stored
              procedure to register the account profile with the
              firewall and place the profile in
       <code class="literal">
        RECORDING
       </code>
       (training) mode:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa21145759"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CALL</span> mysql<span class="token punctuation">.</span>sp_set_firewall_mode<span class="token punctuation">(</span><span class="token string">'fwuser@localhost'</span><span class="token punctuation">,</span> <span class="token string">'RECORDING'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
      </div>
      <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
       <div class="admon-title">
        Note
       </div>
       <p>
        If you have installed MySQL Enterprise Firewall in a custom schema, then
                make appropriate substitution for your system. For
                example, if the firewall is installed in the
        <code class="literal">
         fwdb
        </code>
        schema, then execute the stored
                procedures like this:
       </p>
       <div class="copytoclipboard-wrapper">
        <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa8355388"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CALL</span> fwdb<span class="token punctuation">.</span>sp_set_firewall_mode<span class="token punctuation">(</span><span class="token string">'fwuser@localhost'</span><span class="token punctuation">,</span> <span class="token string">'RECORDING'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
       </div>
       <p>
       </p>
      </div>
     </li>
     <li class="listitem">
      <p>
       To train the registered account profile, connect to the
              server as
       <code class="literal">
        fwuser
       </code>
       from the server host
              so that the firewall sees a session account of
       <code class="literal">
        fwuser@localhost
       </code>
       . Then use the account
              to execute some statements to be considered legitimate for
              the profile. For example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa60282430"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> first_name<span class="token punctuation">,</span> last_name <span class="token keyword">FROM</span> customer <span class="token keyword">WHERE</span> customer_id <span class="token operator">=</span> <span class="token number">1</span><span class="token punctuation">;</span>
<span class="token keyword">UPDATE</span> rental <span class="token keyword">SET</span> return_date <span class="token operator">=</span> <span class="token function">NOW</span><span class="token punctuation">(</span><span class="token punctuation">)</span> <span class="token keyword">WHERE</span> rental_id <span class="token operator">=</span> <span class="token number">1</span><span class="token punctuation">;</span>
<span class="token keyword">SELECT</span> get_customer_balance<span class="token punctuation">(</span><span class="token number">1</span><span class="token punctuation">,</span> <span class="token function">NOW</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
      </div>
      <p>
       Because the profile is in
       <code class="literal">
        RECORDING
       </code>
       mode, the firewall records the normalized digest form of
              the statements as rules in the profile allowlist.
      </p>
      <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
       <div class="admon-title">
        Note
       </div>
       <p>
        Until the
        <code class="literal">
         fwuser@localhost
        </code>
        account
                profile receives statements in
        <code class="literal">
         RECORDING
        </code>
        mode, its allowlist is
                empty, which is equivalent to
        <span class="quote">
         “
         <span class="quote">
          deny all.
         </span>
         ”
        </span>
        No statement can match an empty allowlist, which has
                these implications:
       </p>
       <div class="itemizedlist">
        <ul class="itemizedlist" style="list-style-type: disc; ">
         <li class="listitem">
          <p>
           The account profile cannot be switched to
           <code class="literal">
            PROTECTING
           </code>
           mode. It would reject
                    every statement, effectively prohibiting the account
                    from executing any statement.
          </p>
         </li>
         <li class="listitem">
          <p>
           The account profile can be switched to
           <code class="literal">
            DETECTING
           </code>
           mode. In this case, the
                    profile accepts every statement but logs it as
                    suspicious.
          </p>
         </li>
        </ul>
       </div>
      </div>
     </li>
     <li class="listitem">
      <p>
       At this point, the account profile information is cached.
              To see this information, query the
       <code class="literal">
        INFORMATION_SCHEMA
       </code>
       firewall tables:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa59737291"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> <span class="token keyword">MODE</span> <span class="token keyword">FROM</span> INFORMATION_SCHEMA<span class="token punctuation">.</span>MYSQL_FIREWALL_USERS
       <span class="token keyword">WHERE</span> USERHOST <span class="token operator">=</span> <span class="token string">'fwuser@localhost'</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> MODE      <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> RECORDING <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> RULE <span class="token keyword">FROM</span> INFORMATION_SCHEMA<span class="token punctuation">.</span>MYSQL_FIREWALL_WHITELIST
       <span class="token keyword">WHERE</span> USERHOST <span class="token operator">=</span> <span class="token string">'fwuser@localhost'</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> RULE                                                                       <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> SELECT `first_name` , `last_name` FROM `customer` WHERE `customer_id` = ?  <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">|</span> SELECT `get_customer_balance` ( ? , NOW ( ) )                              <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">|</span> UPDATE `rental` SET `return_date` = NOW ( ) WHERE `rental_id` = ?          <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">|</span> SELECT @@`version_comment` LIMIT ?                                         <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span></code></pre>
      </div>
      <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
       <div class="admon-title">
        Note
       </div>
       <p>
        The
        <code class="literal">
         @@version_comment
        </code>
        rule comes from
                a statement sent automatically by the
        <a class="link" href="mysql.html" title="6.5.1 mysql — The MySQL Command-Line Client">
         <span class="command">
          <strong>
           mysql
          </strong>
         </span>
        </a>
        client when you connect to the
                server.
       </p>
      </div>
      <div class="important" style="margin-left: 0.5in; margin-right: 0.5in;">
       <div class="admon-title">
        Important
       </div>
       <p>
        Train the firewall under conditions matching application
                use. For example, to determine server characteristics
                and capabilities, a given MySQL connector might send
                statements to the server at the beginning of each
                session. If an application normally is used through that
                connector, train the firewall using the connector, too.
                That enables those initial statements to become part of
                the allowlist for the account profile associated with
                the application.
       </p>
      </div>
     </li>
     <li class="listitem">
      <p>
       Invoke
       <code class="literal">
        sp_set_firewall_mode()
       </code>
       again,
              this time switching the account profile to
       <code class="literal">
        PROTECTING
       </code>
       mode:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa63433214"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CALL</span> mysql<span class="token punctuation">.</span>sp_set_firewall_mode<span class="token punctuation">(</span><span class="token string">'fwuser@localhost'</span><span class="token punctuation">,</span> <span class="token string">'PROTECTING'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
      </div>
      <div class="important" style="margin-left: 0.5in; margin-right: 0.5in;">
       <div class="admon-title">
        Important
       </div>
       <p>
        Switching the account profile out of
        <code class="literal">
         RECORDING
        </code>
        mode synchronizes its
                cached data to the firewall database tables that provide
                persistent underlying storage. If you do not switch the
                mode for a profile that is being recorded, the cached
                data is not written to persistent storage and is lost
                when the server is restarted. The firewall database can
                be the
        <code class="literal">
         mysql
        </code>
        system database or a
                custom schema (see
        <a class="xref" href="firewall-installation.html#firewall-install" title="Installing MySQL Enterprise Firewall">
         Installing MySQL Enterprise Firewall
        </a>
        ).
       </p>
      </div>
     </li>
     <li class="listitem">
      <p>
       Test the account profile by using the account to execute
              some acceptable and unacceptable statements. The firewall
              matches each statement from the account against the
              profile allowlist and accepts or rejects it:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: disc; ">
        <li class="listitem">
         <p>
          This statement is not identical to a training
                  statement but produces the same normalized statement
                  as one of them, so the firewall accepts it:
         </p>
         <div class="copytoclipboard-wrapper">
          <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa5622187"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> first_name<span class="token punctuation">,</span> last_name <span class="token keyword">FROM</span> customer <span class="token keyword">WHERE</span> customer_id <span class="token operator">=</span> <span class="token string">'48'</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> first_name <span class="token punctuation">|</span> last_name <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> ANN        <span class="token punctuation">|</span> EVANS     <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span></code></pre>
         </div>
        </li>
        <li class="listitem">
         <p>
          These statements match nothing in the allowlist, so
                  the firewall rejects each with an error:
         </p>
         <div class="copytoclipboard-wrapper">
          <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa32048369"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> first_name<span class="token punctuation">,</span> last_name <span class="token keyword">FROM</span> customer <span class="token keyword">WHERE</span> customer_id <span class="token operator">=</span> <span class="token number">1</span> <span class="token operator">OR</span> <span class="token boolean">TRUE</span><span class="token punctuation">;</span>
<span class="token output">ERROR 1045 (28000)<span class="token punctuation">:</span> Statement was blocked by Firewall</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">SHOW</span> <span class="token keyword">TABLES</span> <span class="token operator">LIKE</span> <span class="token string">'customer%'</span><span class="token punctuation">;</span>
<span class="token output">ERROR 1045 (28000)<span class="token punctuation">:</span> Statement was blocked by Firewall</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">TRUNCATE</span> <span class="token keyword">TABLE</span> mysql<span class="token punctuation">.</span>slow_log<span class="token punctuation">;</span>
<span class="token output">ERROR 1045 (28000)<span class="token punctuation">:</span> Statement was blocked by Firewall</span></code></pre>
         </div>
        </li>
        <li class="listitem">
         <p>
          If the
          <a class="link" href="firewall-reference.html#sysvar_mysql_firewall_trace">
           <code class="literal">
            mysql_firewall_trace
           </code>
          </a>
          system variable is enabled, the firewall also writes
                  rejected statements to the error log. For example:
         </p>
         <div class="copytoclipboard-wrapper">
          <pre class="programlisting language-none"><div class="docs-select-all right" id="sa46265879"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-none">[Note] Plugin MYSQL_FIREWALL reported:
'ACCESS DENIED for fwuser@localhost. Reason: No match in allowlist.
Statement: TRUNCATE TABLE `mysql` . `slow_log`'</code></pre>
         </div>
         <p>
          These log messages may be helpful in identifying the
                  source of attacks, should that be necessary.
         </p>
        </li>
       </ul>
      </div>
     </li>
    </ol>
   </div>
   <p>
    The firewall account profile now is trained for the
    <code class="literal">
     fwuser@localhost
    </code>
    account. When clients
          connect using that account and attempt to execute statements,
          the profile protects MySQL against statements not matched by
          the profile allowlist.
   </p>
   <p>
    It is possible to detect intrusions by logging nonmatching
          statements as suspicious without denying access. First, put
          the account profile in
    <code class="literal">
     DETECTING
    </code>
    mode:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa59206685"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CALL</span> mysql<span class="token punctuation">.</span>sp_set_firewall_mode<span class="token punctuation">(</span><span class="token string">'fwuser@localhost'</span><span class="token punctuation">,</span> <span class="token string">'DETECTING'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    Then, using the account, execute a statement that does not
          match the account profile allowlist. In
    <code class="literal">
     DETECTING
    </code>
    mode, the firewall permits the
          nonmatching statement to execute:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa32610723"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SHOW</span> <span class="token keyword">TABLES</span> <span class="token operator">LIKE</span> <span class="token string">'customer%'</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> Tables_in_sakila (customer%) <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> customer                     <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">|</span> customer_list                <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span></code></pre>
   </div>
   <p>
    In addition, the firewall writes a message to the error log:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-none"><div class="docs-select-all right" id="sa57734148"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-none">[Note] Plugin MYSQL_FIREWALL reported:
'SUSPICIOUS STATEMENT from 'fwuser@localhost'. Reason: No match in allowlist.
Statement: SHOW TABLES LIKE ?'</code></pre>
   </div>
   <p>
    To disable an account profile, change its mode to
    <code class="literal">
     OFF
    </code>
    :
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa83625449"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CALL</span> mysql<span class="token punctuation">.</span>sp_set_firewall_mode<span class="token punctuation">(</span><span class="token keyword"><em class="replaceable">user</em></span><span class="token punctuation">,</span> <span class="token string">'OFF'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    To forget all training for a profile and disable it, reset it:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa95946845"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CALL</span> mysql<span class="token punctuation">.</span>sp_set_firewall_mode<span class="token punctuation">(</span><span class="token keyword"><em class="replaceable">user</em></span><span class="token punctuation">,</span> <span class="token string">'RESET'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    The reset operation causes the firewall to delete all rules
          for the profile and set its mode to
    <code class="literal">
     OFF
    </code>
    .
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="firewall-monitoring">
       </a>
       Monitoring the Firewall
      </h5>
     </div>
    </div>
   </div>
   <p>
    To assess firewall activity, examine its status variables. For
          example, after performing the procedure shown earlier to train
          and protect the
    <code class="literal">
     fwgrp
    </code>
    group profile, the
          variables look like this:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa11573103"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SHOW</span> <span class="token keyword">GLOBAL</span> <span class="token keyword">STATUS</span> <span class="token operator">LIKE</span> <span class="token string">'Firewall%'</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> Variable_name              <span class="token punctuation">|</span> Value <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> Firewall_access_denied     <span class="token punctuation">|</span> 3     <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">|</span> Firewall_access_granted    <span class="token punctuation">|</span> 4     <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">|</span> Firewall_access_suspicious <span class="token punctuation">|</span> 1     <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">|</span> Firewall_cached_entries    <span class="token punctuation">|</span> 4     <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span></code></pre>
   </div>
   <p>
    The variables indicate the number of statements rejected,
          accepted, logged as suspicious, and added to the cache,
          respectively. The
    <a class="link" href="firewall-reference.html#statvar_Firewall_access_granted">
     <code class="literal">
      Firewall_access_granted
     </code>
    </a>
    count is 4 because of the
    <code class="literal">
     @@version_comment
    </code>
    statement sent by the
    <a class="link" href="mysql.html" title="6.5.1 mysql — The MySQL Command-Line Client">
     <span class="command">
      <strong>
       mysql
      </strong>
     </span>
    </a>
    client each of
          the three times you connected using the registered account,
          plus the
    <a class="link" href="show-tables.html" title="15.7.7.39 SHOW TABLES Statement">
     <code class="literal">
      SHOW TABLES
     </code>
    </a>
    statement
          that was not blocked in
    <code class="literal">
     DETECTING
    </code>
    mode.
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="firewall-account-profile-migration">
       </a>
       Migrating Account Profiles to Group Profiles
      </h5>
     </div>
    </div>
   </div>
   <p>
    MySQL Enterprise Firewall supports account profiles that each apply to a single
          account and also group profiles that each can apply to
          multiple accounts. A group profile enables easier
          administration when the same allowlist is to be applied to
          multiple accounts: instead of creating one account profile per
          account and duplicating the allowlist across all those
          profiles, create a single group profile and make the accounts
          members of it. The group allowlist then applies to all the
          accounts.
   </p>
   <p>
    A group profile with a single member account is logically
          equivalent to an account profile for that account, so it is
          possible to administer the firewall using group profiles
          exclusively, rather than a mix of account and group profiles.
          For new firewall installations, that is accomplished by
          uniformly creating new profiles as group profiles and avoiding
          account profiles.
   </p>
   <p>
    Due to the greater flexibility offered by group profiles, it
          is recommended that all new firewall profiles be created as
          group profiles. Account profiles are deprecated, and subject
          to removal in a future MySQL version. For upgrades from
          firewall installations that already contain account profiles,
          MySQL Enterprise Firewall includes a stored procedure named
    <code class="literal">
     sp_migrate_firewall_user_to_group()
    </code>
    to help
          you convert account profiles to group profiles. To use it,
          perform the following procedure as a user who has the
    <a class="link" href="privileges-provided.html#priv_firewall-admin">
     <code class="literal">
      FIREWALL_ADMIN
     </code>
    </a>
    privilege:
   </p>
   <div class="orderedlist">
    <ol class="orderedlist" type="1">
     <li class="listitem">
      <p>
       Run the
       <code class="filename">
        firewall_profile_migration.sql
       </code>
       script
              to install the
       <code class="literal">
        sp_migrate_firewall_user_to_group()
       </code>
       stored procedure. The script is located in the
       <code class="filename">
        share
       </code>
       directory of your MySQL
              installation.
      </p>
      <p>
       Specify the same firewall database name on the command
              line that you previously defined for your firewall
              installation. The example here specifies the system
              database,
       <code class="literal">
        mysql
       </code>
       .
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa83726553"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">mysql</span> <span class="token property">-u</span> root <span class="token property">-p</span> <span class="token property">-D</span> mysql &lt; firewall_profile_migration<span class="token punctuation">.</span>sql
Enter password<span class="token punctuation">:</span> <span class="token punctuation"></span><em class="replaceable"><span class="token punctuation">(</span>enter root password here<span class="token punctuation">)</span></em><span class="token punctuation"></span></code></pre>
      </div>
      <p>
       If you installed MySQL Enterprise Firewall in a custom schema, make the
              appropriate substitution for your system.
      </p>
     </li>
     <li class="listitem">
      <p>
       Identify which account profiles exist by querying the
              Information Schema
       <a class="link" href="information-schema-mysql-firewall-users-table.html" title="28.7.2 The INFORMATION_SCHEMA MYSQL_FIREWALL_USERS Table">
        <code class="literal">
         MYSQL_FIREWALL_USERS
        </code>
       </a>
       table.
              For example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa68655544"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> USERHOST <span class="token keyword">FROM</span> INFORMATION_SCHEMA<span class="token punctuation">.</span>MYSQL_FIREWALL_USERS<span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> USERHOST                      <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> admin@localhost               <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">|</span> local_client@localhost        <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">|</span> remote_client@abc.example.com <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       For each account profile identified by the previous step,
              convert it to a group profile. Replace the
       <code class="literal">
        mysql.
       </code>
       prefix with the actual firewall
              database name, if necessary:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa35693421"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CALL</span> mysql<span class="token punctuation">.</span>sp_migrate_firewall_user_to_group<span class="token punctuation">(</span><span class="token string">'admin@localhost'</span><span class="token punctuation">,</span> <span class="token string">'admins'</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token keyword">CALL</span> mysql<span class="token punctuation">.</span>sp_migrate_firewall_user_to_group<span class="token punctuation">(</span><span class="token string">'local_client@localhost'</span><span class="token punctuation">,</span> <span class="token string">'local_clients'</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token keyword">CALL</span> mysql<span class="token punctuation">.</span>sp_migrate_firewall_user_to_group<span class="token punctuation">(</span><span class="token string">'remote_client@localhost'</span><span class="token punctuation">,</span> <span class="token string">'remote_clients'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
      </div>
      <p>
       In each case, the account profile must exist and must not
              currently be in
       <code class="literal">
        RECORDING
       </code>
       mode, and the
              group profile must not already exist. The resulting group
              profile has the named account as its single enlisted
              member, which is also set as the group training account.
              The group profile operational mode is taken from the
              account profile operational mode.
      </p>
     </li>
     <li class="listitem">
      <p>
       (Optional) Remove
       <code class="literal">
        sp_migrate_firewall_user_to_group()
       </code>
       :
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa94992090"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">DROP</span> <span class="token keyword">PROCEDURE</span> <span class="token keyword">IF</span> <span class="token keyword">EXISTS</span> mysql<span class="token punctuation">.</span>sp_migrate_firewall_user_to_group<span class="token punctuation">;</span></code></pre>
      </div>
      <p>
       If you installed MySQL Enterprise Firewall in a custom schema, make the
              appropriate substitution for your system.
      </p>
     </li>
    </ol>
   </div>
   <p>
    For additional details about
    <code class="literal">
     sp_migrate_firewall_user_to_group()
    </code>
    , see
    <a class="xref" href="firewall-reference.html#firewall-stored-routines-miscellaneous" title="Firewall Miscellaneous Stored Procedures">
     Firewall Miscellaneous Stored Procedures
    </a>
    .
   </p>
  </div>
 </div>
 <br/>
</div>
