Enable MFA for a user，enablemfa

Enable MFA for a user，enablemfa

• If you are root/admin account, in order to configure a virtual MFA device, you must have physical access to the device.For example, if you are configuring MFA for a user who will use a smartphone to generate an OTP, you must have the smartphone available in order to finish the wizard. Because of this, you might want to let them configure the devices themselves. If the following policy is attached to a user or to a group that the user is in, the user can manage configure and manage his or her own virtual MFA device using the AWS Management Console.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowUsersToCreateDeleteTheirOwnVirtualMFADevices",
      "Effect": "Allow",
      "Action": ["iam:*VirtualMFADevice"],
      "Resource": ["arn:aws:iam::ACCOUNT-ID-WITHOUT-HYPHENS:mfa/${aws:username}"]
    },
    {
      "Sid": "AllowUsersToEnableSyncDisableTheirOwnMFADevices",
      "Effect": "Allow",
      "Action": [
        "iam:DeactivateMFADevice",
        "iam:EnableMFADevice",
        "iam:ListMFADevices",
        "iam:ResyncMFADevice"
      ],
      "Resource": ["arn:aws:iam::ACCOUNT-ID-WITHOUT-HYPHENS:user/${aws:username}"]
    },
    {
      "Sid": "AllowUsersToListVirtualMFADevices",
      "Effect": "Allow",
      "Action": ["iam:ListVirtualMFADevices"],
      "Resource": ["arn:aws:iam::ACCOUNT-ID-WITHOUT-HYPHENS:mfa/*"]
    },
    {
      "Sid": "AllowUsersToListUsersInConsole",
      "Effect": "Allow",
      "Action": ["iam:ListUsers"],
      "Resource": ["arn:aws:iam::ACCOUNT-ID-WITHOUT-HYPHENS:user/*"]
    }
  ]
}

Note: 

• To configure and enable a virtual MFA device for a user
  • Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.
  • In the navigation pane, click User and then select the user you want to enable the virtual MFA for.
  • In the user details pane, select Security Credentials, and then click Manage MFA Device.
  • In the Manage MFA Device wizard, select A virtual MFA device and then click Continue.
  • Confirm that a virtual MFA application is installed on the user's mobile device and then click Continue. (For a list of apps that you can use as virtual MFA devices, see Multi-Factor Authentication.) IAM generates and displays configuration information for the virtual MFA device, including a QR code similar to the following graphic.
  • With the Manage MFA Device wizard still open, open the virtual MFA application on the device. If the device supports QR codes, the easiest way to configure the application is to use the application to scan the QR code. If you cannot scan the code, you can enter the secret configuration key manually.
    • To use the QR code to configure the virtual MFA device, follow the app instructions for scanning the code. For example, you might need to tap the camera icon or tap a command like Scan account barcode, and then use the device's camera to scan the code.
    • If you cannot scan the code, enter the configuration information manually by typing the Secret Configuration Key value into the application. For example, to do this in the AWS Virtual MFA application, tapManually add account, and then type the secret configuration key and click Create.
    • NoteThe QR code and secret configuration key are unique and cannot be reused.
  • When you are finished configuring the device, the device starts generating six-digit numbers.
  • In the IAM Manage MFA Device wizard, in the Authentication Code 1 box, type the six-digit number that's currently displayed by the MFA device. Wait 30 seconds for the device to generate a new number, and then type the new six-digit number into the Authentication Code 2 box.Click Continue.

Note: If you are root/admin account, you can enable MFA for the users (need the users' mfa device or smart phone which runs virtual mfa device app) or let them enable it themselves via granting them privileges to enable MFA. 

ftp服务器的配置 ftp 叫做文件传输协议 他已经有40年的历史了 它以明文的如过userlist_enable=NO,userlist_deny=YES,则指定使文件/etc/vsftpd.
 

华为交换机指令
[SwitchA]Isolate-user-vlan <x> secondary <list> 设置主vlan包括的子vlan
参考资料：zhidao.baidu.com/question/208263306.html?si=1