> Source: [sk181305](https://support.checkpoint.com/results/sk/sk181305)

# sk181305 - Gaia administrator "cpsho_user"  is added on Management Servers

| Property | Value |
|----------|-------|
| Solution ID | sk181305 |
| Date Created | 2023-07-26 |
| Last Modified | 2026-02-19 |
| Technical Level | General |
| Products | Security Management Server, Multi-Domain Security Management Server |
| Versions | R82, R81.20, R81.10 (EOS), R81 (EOS), R81 (EOS), R81.10 (EOS), R81.20, R82 |
| OS | Gaia |
| Platform | Smart-1 |

## Symptoms

- * Gaia OS `cpsho_user` administrator is added with low administrative permission privileges on Quantum Security Management server, Multi-Domain Management server, Log Server, and MLM.  

* The "`clish -c 'show configuration' | grep cpsho_user`" command returns:  

  `add user cpsho_user uid 1000 homedir /home/cpsho_user`  
  `set user cpsho_user gid 100 shell /etc/cli.sh`  
  `set user cpsho_user realname "cpsho_user"`  
  `set user cpsho_user password-hash`  

* The "`grep cpsho_user /var/log/messages*`" command returns:  

  `fwm clish[Y]: cmd by admin: Processing : add user cpsho_user uid 1000 homedir /home/cpsho_user (cmd md5: 6d966d6c6b960cf9f5dc11b372e54124)`  
  `fwm xpand[X]: admin localhost t +mrma:users:user:cpsho_user t`  
  `fwm xpand[X]: admin localhost t +mrma:users:user:cpsho_user:access_mechanism:Web t`  
  `fwm xpand[X]: admin localhost t +mrma:users:user:cpsho_user:access_mechanism:CLI t`  
  `fwm xpand[X]: User entry created for "cpsho_user" in the password database`  
  `fwm xpand[X]: admin localhost t +passwd:cpsho_user:passwd`

## Solution

* **What permissions and credentials cpsho_user has?**   
  > The password is randomly generated and 108 characters long; it is not stored anywhere. Hence this user is never used to log in.  
  > Gaia OS has the definition of the user; it has Non-root permission (groupid 100).
* **When is cpsho_user created?**   
  > Installation of the Web SmartConsole package triggers the creation of the user. Web SmartConsole can be installed manually, by automatic update, and as part of the Jumbo Hotfix Accumulator.
* **Why is cpsho_user created?**   
  > The cpsho_user is created for internal system purposes. Several dockers on the Management Servers use this low-privileged user to read input files and write to log files. For example, Infinity Services and Web SmartConsole.
* **Can cpsho_user be deleted?**   
  > Deleting this user is not recommended and might have an impact on several Management features - Infinity Services, Web SmartConsole, and SmartConsole (as some views and pages of SmartConsole are based on Web SmartConsole as infrastructure).

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content