# Moving to the context of a Security Group Member or adding a new Security Group Member fails

**Product:** Maestro HyperScale Firewall, Scalable Chassis  
**Version:** R80.20SP (EOS), R80.30SP (EOS), R81 (EOS), R81.10 (EOS), R81.20  
**OS:** Gaia  
**Last Modified:** 2025-08-12

## Symptoms

- When you add a new Security Group Member (SGM) to a Security Group, the procedure takes a long time or is stuck.
- When you move between the Security Group Members with the `member` (or `m`) command, the system uses the "root" user, not the "admin user" for this internal SSH connection.

## Cause

The entry order in the `/etc/passwd` file is wrong - the "root" user entry appears above the "admin" user entry.

The "admin" user entry must always appear above the "root" user entry.

## Solution

This problem was fixed. The fix is included from:

- Check Point R82
- [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) - from Take 111
- [Jumbo Hotfix Accumulator for R81.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) - from Take 177

If you choose not to upgrade, change the order of entries in the `/etc/passwd` file. Do this for all SGMs.

1. Connect to the command line on the Security Group.
2. Log in.
3. If the default shell is Gaia gClish, then go to the Expert mode:
   
   ```
   expert
   ```
4. Back up the current `/etc/passwd` file:
   
   ```
   g_all cp -v /etc/passwd{,_BKP}
   ```
5. Edit the current `/etc/passwd` file:
   
   ```
   vi /etc/passwd
   ```
6. Make sure the "admin" user entry appears above the "root" user entry.
   
   Example:
   
   ```
   admin:x:0:0::/home/admin:/bin/bash
   monitor:x:102:100:Monitor:/home/monitor:/etc/cli.sh
   root:x:0:0:root:/root:/sbin/nologin
   test:x:0:0:Test:/home/test/:/bin/gclish
   _lldpd:x:103:101:LLDP daemon:/home/_lldpd:/sbin/nologin
   nobody:x:99:99:Nobody:/:/sbin/nologin
   postfix:x:1001:1001:Postfix:/home/postfix:/sbin/nologin
   rpm:x:37:37::/var/lib/rpm:/sbin/nologin
   shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
   pcap:x:77:77::/var/arpwatch:/sbin/nologin
   halt:x:7:0:halt:/sbin:/sbin/halt
   cp_postgres:x:1008:0:Postgres:/home/cp_postgres:/bin/sh
   cp_extensions:x:8086:1:CP Extensions:/home/cp_extensions:/bin/sh
   _nonlocl:x:96:100:Non-local user:/home/_nonlocl:/etc/cli.sh
   vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
   cpep_user:x:1500:1500::/home/cpep_user:/sbin/nologin
   sshd:x:74:74:Privilege-separated:/var/empty/sshd:/sbin/nologin
   ```
7. Save the changes in the file and exit Vi editor.
8. Copy the modified file to all Security Group Members:
   
   ```
   asg_cp2blades /etc/passwd
   ```
9. Close all SSH sessions to the Security Group and all Security Group Members.
10. Connect to the command line on the Security Group.
11. Log in.
12. If the default shell is Gaia gClish, then go to the Expert mode:
   
   ```
   expert
   ```
13. Get the current user:
   
   ```
   whoami
   ```
   The output must show the username with which you logged in to the command line on the Security Group.
14. Use the `member` command to move to the context of a different Security Group Member:
   
   ```
   member <ID of Security Group Member>
   ```
15. Get the current user:
   
   ```
   whoami
   ```
   The output must show the username with which you logged in to the command line on the Security Group and not the "root" user.

#### NOTE

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.

## Article Properties

- **Access Level:** General
- **Status:** Approved by TAC
- **Date Created:** 2022-10-27
- **Last Modified:** 2025-08-12