- Products
- Learn
- Local User Groups
- Partners
- More
Step Into the Future of
AI-Powered Cyber Security
The State of Ransomware Q1 2026
Key Trends and Their Impact
AI Security Masters E8:
Claude Mythos: New Era in Cyber Security
Blueprint Architecture for Securing
The AI Factory & AI Data Center
Call For Papers
Your Expertise. Our Stage
CheckMates Go:
CheckMates Fest
Hi all:
Yesterday we upgraded an 5400 appliance to R81.10 Take 130. Since then, when you log in this message shows up:
End of banner message from server
admin@192.168.x.x's password:
Last login: Fri Apr 19 08:49:52 2024 from 192.168.x.x
if: Expression Syntax.
then: Command not found.
[admin@gw01 ~]#
We are still checking the logs files of the system but nothing found yet. It seems the interpreter line from a script is incorrect but, which one?
Any idea?
Thanks in advanced
Regards
Hi,
We fixed it by changing the admin shell from /bin/csh to /bin/bash.
Thank you for your answers!
Regards
Can you try to change the banner message? Maybe there is a weird character in it or something? Maybe go back to something default like: This system is for authorized use only.
You can change the banner in the webGUI -> System Management -> Messages -> Banner Message
Or via CLI
Hi Lesley,
Thanks for your answer. I changed the banner message but the message is still there:
Using username "admin".
Pre-authentication banner message from server:
| This system is for authorized use only
End of banner message from server
admin@192.168.x.x's password:
Last login: Fri Apr 19 09:36:48 2024 from 192.168.x.x
if: Expression Syntax.
then: Command not found.
[admin@gw01 ~]#
Regards
Have you done a reboot? And tested with different SSH user?
I am afraid what Albrecht also states that probably a reinstall is needed. You can try with TAC for them to check.
I cannot find any open bugs or relevant SK's.
I would suggest to do a fresh install of the GW, looks like some file corruption to me.
Hi,
We fixed it by changing the admin shell from /bin/csh to /bin/bash.
Thank you for your answers!
Regards
That was first thing that came to my mind when I read your post. You can always change it to /etc/cli.sh if you dont want to go to expert mode when logging in
example -> chsh -s /etc/cli.sh admin
Best,
Andy
Strange ! That has changed during upgrade? Or just no banner issue before upgrade?
The banner was configured before the upgrade yes. Don't know why this message showed up after it.
And you did not start admin session in expert mode previously? Mostly done for WinSCP connect...
Yes, I did several days before the upgrade in order to transfer the 81.10 images (81.10 base and JHF).
Leaderboard
Epsum factorial non deposit quid pro quo hic escorol.
| User | Count |
|---|---|
| 26 | |
| 13 | |
| 11 | |
| 10 | |
| 7 | |
| 7 | |
| 6 | |
| 6 | |
| 6 | |
| 6 |
Wed 13 May 2026 @ 11:00 AM (EDT)
TechTalk: The State of Ransomware Q1 2026: Key Trends and Their ImpactThu 14 May 2026 @ 07:00 PM (EEST)
Under the Hood: Presentando Check Point Cloud Firewall como ServicioFri 29 May 2026 @ 09:00 AM (EDT)
Caracas: Executive Breakfast: Innovación en Ciberseguridad – IA y Threat IntelligenceAbout CheckMates
Learn Check Point
Advanced Learning
YOU DESERVE THE BEST SECURITY