> Source: [sk105322](https://support.checkpoint.com/results/sk/sk105322)

# sk105322 - "CLINFR0829 Unable to get user permissions" error when TACACS non-local user runs "clish -c" command from Expert mode

| Property | Value |
|----------|-------|
| Solution ID | sk105322 |
| Date Created | 2015-03-23 |
| Last Modified | 2023-04-26 |
| Technical Level | General |
| Products | Security Gateway, Security Management Server, Multi-Domain Security Management Server |
| Versions | R82.10, R82, R81.20, R82.10, R82, R81.20, R82.10, R82.20, R81.20, R82, R82.20 |
| OS | Gaia |

## Symptoms

- * When TACACS+ non-local user runs *clish -c "some_clish_syntax"* command from Expert mode (e.g., *clish -c "show interface eth0"*), the following errors appear:

  ```
  
  [Expert@HostName]# clish -c "some_clish_syntax"
  CLINFR0829  Unable to get user permissions.
  CLINFR0599  Failed to build ACLs.
  ```

* The same user is able to execute the required commands when logged in to Clish.

* The involved TACACS+ non-local user has enough privileges to execute the required commands.

* When TACACS+ non-local user runs *clish -c "some_clish_syntax"* command from Expert mode (e.g., *clish -c "show interface eth0"*) on VSX Gateway, the following error appears:

  ```
  
  [Expert@HostName:0]# clish -c "some_clish_syntax"
  CLINFR0220  User is not allowed to access any virtual-system.
  ```

## Cause

Gaia OS fails to find the RBA role for TACACS+ non-local user.

## Solution

This problem was fixed. The fix is included in:

* [Check Point R80.10](https://support.checkpoint.com/results/sk/sk111841)
* [Jumbo Hotfix Accumulator for R77.30](http://supportcontent.checkpoint.com/solutions?id=sk106162) - from *Take_95*

For **lower [supported](http://www.checkpoint.com/support-services/support-life-cycle-policy/enterprise-software-support-timeline/index.html) versions** , Check Point can supply a **Hotfix** . [Contact Check Point Support](http://www.checkpoint.com/services/contact/index.html) to get a Hotfix for this issue.  
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.

**Hotfix installation instructions:**

1. Hotfix has to be installed on **machine running Gaia OS**.

   **Notes:**
   * In cluster environment, this procedure must be performed on *all* members of the cluster.
   * In Management HA environment, this procedure must be performed on *both* Management Servers.

   <br />

   <br />

2. Transfer the hotfix package to the machine (into some directory, e.g., */some_path_to_fix/* ).   

3. Unpack the hotfix package:

   ```
   [Expert@HostName]# cd /some_path_to_fix/
   [Expert@HostName]# tar -zxvf SecurePlatform_HOTFIX_NAME.tgz
   ```

4. Install the hotfix:

   ```
   [Expert@HostName]# ./SecurePlatform_HOTFIX_NAME
   ```

   **Note:** The script will stop all of Check Point services (*cpstop* ) - read the output on the screen.   

5. Reboot the machine.

The following ***workaround*** is available:

1. Create a plain text file with the required Clish commands (all empty lines and lines starting with '#' character are ignored).   

2. Log in to Clish.   

3. Run the following command:  
   ***HostName\> load configuration /path_to/file_name***

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content