> Source: [sk183291](https://support.checkpoint.com/results/sk/sk183291)

# sk183291 - TACACS / RADIUS Users Cannot SSH After JHF Take 96 Installation

| Property | Value |
|----------|-------|
| Solution ID | sk183291 |
| Date Created | 2025-03-26 |
| Last Modified | 2026-07-27 |
| Technical Level | General |
| Products | Scalable Platforms |
| Versions | R82, R81.20 |
| OS | Gaia |

## Symptoms

- * RADIUS users cannot log in over SSH. However, access to Gaia Portal is successful.
* Error message on shell: 
  `Unable to get user permissions
  Connection to xxxxx closed
  `

* Errors in /var/log/messages: 
  `
  clish[PID]: User UserName running clish -c with ReadWrite permission
  clish[PID]: cmd by UserName : Start executing : clish -c ... (cmd md5: c358b286c86181d94e9197ca64432795)
  clish[PID]: User UserName finished running clish -c due to an error from CLI shell
  `

* Errors in /var/log/secure: 
  `
  sshd[PID]: User ` not allowed because shell /etc/gcli.sh does not exist

* The non-local RADIUS users default shell is set to Global Clish (/bin/gclish) or regular Clish (/etc/cli.sh): 
  `
  set aaa radius-servers default-shell /etc/cli.sh
  `

  -OR-


  `
  set aaa radius-servers default-shell /bin/gclish
  `

## Cause

After the implementation of Multi-Factor Authentication, the Global Clish shell was moved from */bin/gclish* to */etc/gcli.sh;* The new shell bindings to */etc/gcli.sh* are missing.

## Solution

[Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.  

A Support Engineer will make sure the Hotfix is compatible with your environment before providing it.  
For faster resolution and verification, collect these files:

1. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Management Server involved in the case.
2. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Security Gateway / each Cluster Member involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://support.checkpoint.com/results/sk/sk168597).
**Important:** When the fix is installed, manually change the RADIUS users default shell to **/etc/gcli.sh** via global clish command:  
set aaa radius-servers default-shell **/etc/gcli.sh**   

<br />

**The following workaround is also available:**   

1. Via expert mode, backup /etc/radius_def_shell:  
   `g_cp -a /etc/radius_def_shell{,_BKP}`  

2. Update /etc/radius_def_shell to include /etc/gcli.sh instead of /bin/gclish:  
   `g_all -a "echo '/etc/gcli.sh' > /etc/radius_def_shell"`  

3. Verify /etc/gcli.sh matches on all SGMs:  
   `g_cat -a /etc/radius_def_shell`  

4. Create a symbolic link for /etc/gcli.sh pointing to /etc/cli.sh:  
   `g_all -a "ln -s /etc/cli.sh /etc/gcli.sh"`  

5. Verify that the symbolic link was created on all SGMs:  
   `g_all -a "ls -l /etc/gcli.sh"`

<br />

After using the workaround, no change in the set command is needed. If you check `show configuration aaa` it will return the same as below but ssh will start working.   

**EXAMPLE:** `set aaa radius-servers default-shell /bin/gclish`

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content