> Source: [sk172910](https://support.checkpoint.com/results/sk/sk172910)

# sk172910 - ifi_user  user entity appears on Gaia (GW/StandAlone)

| Property | Value |
|----------|-------|
| Solution ID | sk172910 |
| Date Created | 2021-04-06 |
| Last Modified | 2021-06-28 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R81 (EOS) |
| OS | Gaia |
| Platform | TE |

## Symptoms

- * IFI_USER was added to /etc/passwd file. You can track it with 'less /etc/passwd' and you will find - "ifi_user:x:8087:8087::/home/ifi_user:/bin/bash"
* The *$FWDIR/log/ifi_log.elg* file on a Threat Emulation appliance shows:

  ```
  
  [PID] - MainProcess - [Date Time],152 - __main__ - ifi_server - start_server - INFO - ifi_user added successfully
  ```

* The */var/log/audit/audit_log.1* file on a Threat Emulation appliance shows:

  ```
  
  type=USER_CHAUTHTOK msg=audit(xxx): pid=xxx uid=0 auid=xxx ses=xxx subj=kernel msg='op=adding user acct=ifi_user  exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=success)'
  
  type=USER_CHAUTHTOK msg=audit(xxx): pid=xxx uid=0 auid=xxx ses=xxx subj=kernel msg='op=adding home directory acct=ifi_user exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=success)'
  ```

## Cause

*ifi_user* is part of the Threat Emulation scanning components added as part of Engine Build 59.990000543. It helps with static inspection of files, while dynamically cleaning the files from obfuscations/evasions and performing other methods. T  
The user was only in use in version R81, but since the infrastructure is cross-version you might find it also on R80.40 and below without any usage.   

It was intended to use for a specific engine in order to enhanced security on your GW. **There is no impact by any means to your GW security.** However, since we understand the concerns customers might have from adding another user we decided to deprecate it, so this user is no longer in use and should be deleted.   

<br />

<br />

<br />

<br />

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content