> Source: [sk1000006](https://support.checkpoint.com/results/sk/sk1000006)

# sk1000006 - Local Gaia users log in without Two-Factor Authentication when it is enabled

| Property | Value |
|----------|-------|
| Solution ID | sk1000006 |
| Date Created | 2026-08-20 |
| Last Modified | 2026-09-16 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.20 |
| OS | Gaia |

## Symptoms

- * After a Jumbo Hotfix upgrade, two-factor authentication (2FA) remains visibly configured for local Gaia users but is not enforced.
* Local Gaia users configured with 2FA can log in to WebUI without a valid 2FA verification code.
* Local Gaia users configured with 2FA can log in through SSH without a valid 2FA verification code.
* In WebUI, users can authenticate successfully when the 2FA token field is empty or contains any arbitrary value.
* The issue affects the enforcement of 2FA for local Gaia users only.
* RADIUS users continue to authenticate successfully as expected.

## Cause

During a Gaia Jumbo Hotfix-to-Jumbo Hotfix upgrade, the upgrade process removes previous Jumbo Hotfix RPM packages in the background.  

As part of this removal process, an earlier PAM RPM package can restore the file:

```
/etc/pam.d/system-auth
```

The restored file does not include the `pam_google_authenticator` entry required to enforce two-factor authentication for local Gaia users.

Although the newer Jumbo Hotfix PAM RPM package contains the correct `system-auth` file, RPM treats the active file as an RPM `%config` file. Therefore, RPM preserves the active file instead of replacing it.

RPM will place the corrected file with a suffix, for example:  

```
/etc/pam.d/system-auth.rpmnew
```

As a result:  

* The Gaia database remains intact.
* The local users' 2FA keys remain intact.
* The 2FA configuration still appears correct in Gaia.
* The PAM authentication flow no longer calls `pam_google_authenticator`.
* Gaia does not enforce 2FA for affected local users.

## Solution

This problem was fixed. The fix is included in:

<br />

* [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 166

If you choose not to upgrade, Check Point can supply a **Hotfix** . [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.

<br />

A Support Engineer will make sure the Hotfix is compatible with your environment before providing it. For faster resolution and verification, collect these files:

1. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Management Server involved in the case.

<!-- -->

1. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Security Gateway / each Cluster Member / Security Group involved in the case.

Hotfix installation instruction: Refer to [How to Install a Hotfix](https://support.checkpoint.com/results/sk/sk168597).

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content