# ansible\_ssh\_pass and ansible\_become\_pass in non interactive way

**URL:** <https://forum.ansible.com/t/ansible-ssh-pass-and-ansible-become-pass-in-non-interactive-way/36603>\
**Category:** Ansible Project\
**Created:** [May 8, 2022, 2:03pm UTC](https://forum.ansible.com/t/ansible-ssh-pass-and-ansible-become-pass-in-non-interactive-way/36603 "2022-05-08T14:03:51Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![surender\_rajasekaran](https://avatars.discourse-cdn.com/v4/letter/s/e274bd/32.png) [@surender\_rajasekaran](https://forum.ansible.com/u/surender_rajasekaran)\
**Post date:** [May 8, 2022, 2:03pm UTC](https://forum.ansible.com/t/ansible-ssh-pass-and-ansible-become-pass-in-non-interactive-way/36603/1 "2022-05-08T14:03:51Z")

</div>

Im currently working on ansible to automate few server infrastructure activities, i would like to specify --ask-pass and—ask-become-pass for Ansible in non-interactive way.

My Scenario:

- when i run the below command, I’m getting the expected output after manually providing the SSH and BECOME password.

ansible-playbook ping.yml --ask-pass --ask-become-pass -i hosts -c paramiko

- when i tried executing the below command by placing the ansible\_ssh\_pass and ansible\_become\_pass details in inventory file, it works fine in non interactive way.

ansible-playbook ping.yml -i hosts -c paramiko

$ ansible-playbook ping.yml -i hosts -c paramiko

PLAY [all] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

TASK [Gathering Facts] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

ok: [\*\*\*\*\*\*\*\*\*\*\*\*\*.com]

TASK [ping] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

ok: [\*\*\*\*\*\*\*\*\*\*\*\*\*.com]

PLAY RECAP \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

\*\*\*\*\*\*\*\*\*\*\*\*\*\*.com : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0

but in the above method the credentials are exposed and I feel it is not a best practice. Is there any possible way to handle both the ansible\_ssh\_pass and ansible\_become\_pass in non interactive way other than having the credential details in inventory file?

Ansible version : 2.9.9

OS : Linux

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [May 9, 2022, 1:27pm UTC](https://forum.ansible.com/t/ansible-ssh-pass-and-ansible-become-pass-in-non-interactive-way/36603/2 "2022-05-09T13:27:14Z")

</div>

Use a vaulted file with the variables or inline vaults.

[https://docs.ansible.com/ansible/latest/user\_guide/vault.html](https://docs.ansible.com/ansible/latest/user_guide/vault.html)

---

<div class="post-metadata">

**Author:** ![schoeppi](https://avatars.discourse-cdn.com/v4/letter/s/76d3ee/32.png) [@schoeppi](https://forum.ansible.com/u/schoeppi)\
**Post date:** [May 9, 2022, 1:41pm UTC](https://forum.ansible.com/t/ansible-ssh-pass-and-ansible-become-pass-in-non-interactive-way/36603/3 "2022-05-09T13:41:38Z")

</div>

> Im currently working on ansible to automate few server infrastructure  
> activities, i would like to specify --ask-pass and—ask-become-pass for Ansible  
> in non-interactive way.

Same here...

> • when i tried executing the below command by placing the ansible\_ssh\_pass  
> &nbsp;&nbsp;&nbsp;and ansible\_become\_pass details in inventory file, it works fine in non  
> &nbsp;&nbsp;&nbsp;interactive way.
> 
> ansible-playbook ping.yml -i hosts -c paramiko

[...]

> but in the above method the credentials are exposed and I feel it is not a  
> best practice.

If you control your inventory files via git or other other version control  
systems its a no-go to store the plain text password in the inventory file.

> Is there any possible way to handle both the ansible\_ssh\_pass  
> and ansible\_become\_pass in non interactive way other than having the  
> credential details in inventory file?

See for example here:

\<[https://theorangeone.net/posts/ansible-vault-bitwarden/#setting-up-ansible&gt](https://theorangeone.net/posts/ansible-vault-bitwarden/#setting-up-ansible&gt);

There ansible vault is used or, and thats the way we want to do it,  
Bitwarden as an external source for sensible data. I've also managed to  
crypt sensible information with sops, thats another possebility if ansible  
vault can not be used or don't want to be used.

Unfortunatly there seems to be a bug in ansible versions \<2.10.8 where  
reading out the ansible\_become\_pass via a script seems not to work, at least  
I can not get it to run as described on the page mensioned above.

In my ansible.cfg file I have the following:

[default]  
...  
become\_pass\_file = ./become-password.sh

The become-password.sh script, which is stored in the same directory as the  
ansible.cfg file and which has the permissions to be executed, looks like  
this: