# ansible\_ssh\_pass parameter with salt encrypt value of ansible\_user password makes client server Unreachable on playbook run **URL:** \ **Category:** Ansible Project\ **Created:** [July 28, 2017, 10:58pm UTC](https://forum.ansible.com/t/ansible-ssh-pass-parameter-with-salt-encrypt-value-of-ansible-user-password-makes-client-server-unreachable-on-playbook-run/25124 "2017-07-28T22:58:45Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Lorenzo\_Farinas](https://avatars.discourse-cdn.com/v4/letter/l/a87d85/32.png) [@Lorenzo\_Farinas](https://forum.ansible.com/u/Lorenzo_Farinas)\ **Post date:** [July 28, 2017, 10:58pm UTC](https://forum.ansible.com/t/ansible-ssh-pass-parameter-with-salt-encrypt-value-of-ansible-user-password-makes-client-server-unreachable-on-playbook-run/25124/1 "2017-07-28T22:58:45Z")
I successfully created and tested some Ansible playbooks, that’s when ansible\_ssh\_pass parameter value is the actual password of the ansible\_user for the involved server specified in a group in the /etc/ansible/hosts file. But when the ansible\_ssh\_pass parameter was replaced with its salt encrypt value for security reasons, the playbook run would fail with the server Unreachable. Please advise. ---
**Author:** ![Dick\_Visser](https://avatars.discourse-cdn.com/v4/letter/d/d9b06d/32.png) [@Dick\_Visser](https://forum.ansible.com/u/Dick_Visser)\ **Post date:** [July 29, 2017, 4:09pm UTC](https://forum.ansible.com/t/ansible-ssh-pass-parameter-with-salt-encrypt-value-of-ansible-user-password-makes-client-server-unreachable-on-playbook-run/25124/2 "2017-07-29T16:09:16Z")
The ansible\_ssh\_pass parameter is meant to supply the plain text password only. Anything else ("salt encrypt value" - whatever that may be) won't work. If you're looking to improve security then move away from password authentication and start using public key auth. Dick ---
**Author:** ![Daniel\_JD](https://avatars.discourse-cdn.com/v4/letter/d/f19dbf/32.png) [@Daniel\_JD](https://forum.ansible.com/u/Daniel_JD)\ **Post date:** [July 29, 2017, 5:44pm UTC](https://forum.ansible.com/t/ansible-ssh-pass-parameter-with-salt-encrypt-value-of-ansible-user-password-makes-client-server-unreachable-on-playbook-run/25124/3 "2017-07-29T17:44:54Z")
Also check out Ansible- Vault for more security. [http://docs.ansible.com/ansible/latest/playbooks\_vault.html](http://docs.ansible.com/ansible/latest/playbooks_vault.html) ---
**Author:** ![Lorenzo\_Farinas](https://avatars.discourse-cdn.com/v4/letter/l/a87d85/32.png) [@Lorenzo\_Farinas](https://forum.ansible.com/u/Lorenzo_Farinas)\ **Post date:** [August 2, 2017, 8:50pm UTC](https://forum.ansible.com/t/ansible-ssh-pass-parameter-with-salt-encrypt-value-of-ansible-user-password-makes-client-server-unreachable-on-playbook-run/25124/4 "2017-08-02T20:50:35Z")
Daniel, This is the configuration I have for this server that belongs to the apacheservers group that worked, with the root password explicitly entered in the ansible\_ssh\_pass parameter. [apacheservers] TestRHEL73tr1 ansible\_host=XX.X.XX.XXX ansible\_port=22 ansible\_user=root ansible\_ssh\_pass= I tried to use the vault by creating a .vault\_pass file with its content ansible\_ssh\_pass=value of root password, and then ran ansible-playbook CreateTestfile.yml --vault-password-file /root/.vault\_pass, but I got this following error message: Attempted to read “/etc/ansible/hosts” as ini file: /etc/ansible/hosts:16: Expected key=value host variable assignment, got: ansible\_ssh\_pass Please help on how to properly use the vault concept in securing ansible playbook run. Thanks, Lorenzo ---
**Author:** ![Lorenzo\_Farinas](https://avatars.discourse-cdn.com/v4/letter/l/a87d85/32.png) [@Lorenzo\_Farinas](https://forum.ansible.com/u/Lorenzo_Farinas)\ **Post date:** [August 2, 2017, 10:31pm UTC](https://forum.ansible.com/t/ansible-ssh-pass-parameter-with-salt-encrypt-value-of-ansible-user-password-makes-client-server-unreachable-on-playbook-run/25124/5 "2017-08-02T22:31:25Z")
Dick, How can I start using public key auth on Ansible? What’s its procedure/process and the commands to use in running ansible-playbook when using it? - Thanks, Lorenzo ---
**Author:** ![Lorenzo\_Farinas](https://avatars.discourse-cdn.com/v4/letter/l/a87d85/32.png) [@Lorenzo\_Farinas](https://forum.ansible.com/u/Lorenzo_Farinas)\ **Post date:** [August 3, 2017, 6:55pm UTC](https://forum.ansible.com/t/ansible-ssh-pass-parameter-with-salt-encrypt-value-of-ansible-user-password-makes-client-server-unreachable-on-playbook-run/25124/6 "2017-08-03T18:55:39Z")
I also want to know if anyone can help on how to fix this problem as even though I put back the plain text password to the ansible\_ssh\_pass parameter, the playbook run would still fail with the server Unreachable on the server that had the parameter replaced with its salt encrypt value. ---
**Author:** ![Lorenzo\_Farinas](https://avatars.discourse-cdn.com/v4/letter/l/a87d85/32.png) [@Lorenzo\_Farinas](https://forum.ansible.com/u/Lorenzo_Farinas)\ **Post date:** [August 3, 2017, 10:06pm UTC](https://forum.ansible.com/t/ansible-ssh-pass-parameter-with-salt-encrypt-value-of-ansible-user-password-makes-client-server-unreachable-on-playbook-run/25124/7 "2017-08-03T22:06:06Z")
I noticed that even now when I enter the plain text password on the ansible\_ssh\_pass parameter for the server in the /etc/ansible/hosts file, I would still get the same error message on playbook run when I attempted to use the vault. Can someone help on how this can be resolved so at least I can run the playbook like before with the plain text password on ansible\_ssh\_pass parameter. ---
**Author:** ![alikins](https://avatars.discourse-cdn.com/v4/letter/a/d07c76/32.png) [@alikins](https://forum.ansible.com/u/alikins)\ **Post date:** [August 8, 2017, 5:43pm UTC](https://forum.ansible.com/t/ansible-ssh-pass-parameter-with-salt-encrypt-value-of-ansible-user-password-makes-client-server-unreachable-on-playbook-run/25124/8 "2017-08-08T17:43:48Z")
> I tried to use the vault by creating a .vault\_pass file with its content ansible\_ssh\_pass=value of root password, and then ran ansible-playbook CreateTestfile.yml --vault-password-file /root/.vault\_pass, but I got this following error message: > Attempted to read “/etc/ansible/hosts” as ini file: /etc/ansible/hosts:16: Expected key=value host variable assignment, got: ansible\_ssh\_pass To clarify some terms: ‘vault password’: A password used by vault to encrypt/decrypt content. ‘passwords stored in vault’: A password for something like a user auth or ssh private keys, that is stored in a vault (encrypted with ansible-vault and a vault password) –vault-password-file is for reading a ‘vault password’ from a file. ie, a password used by vault for decrypting/encrypting. ansible\_ssh\_pass would need to be populated from a variable in a vault encrypted vars file (or inventory file) for that example. But that is the wrong approach. The right approach is: **Use ssh keys and ssh-agent instead of trying to store the password in ansible.** A working key based ssh and ssh-agent setup is a prerequisite for practical ansible use. ---
**Author:** ![Lorenzo\_Farinas](https://avatars.discourse-cdn.com/v4/letter/l/a87d85/32.png) [@Lorenzo\_Farinas](https://forum.ansible.com/u/Lorenzo_Farinas)\ **Post date:** [August 10, 2017, 7:19pm UTC](https://forum.ansible.com/t/ansible-ssh-pass-parameter-with-salt-encrypt-value-of-ansible-user-password-makes-client-server-unreachable-on-playbook-run/25124/9 "2017-08-10T19:19:40Z")
Please provide the procedure on how to add ssh-agent and ssh keys to the client with reference to Ansible control machine. My research on this task is not productive. - Thanks, Lorenzo ---
**Author:** ![Dick\_Visser](https://avatars.discourse-cdn.com/v4/letter/d/d9b06d/32.png) [@Dick\_Visser](https://forum.ansible.com/u/Dick_Visser)\ **Post date:** [August 10, 2017, 9:03pm UTC](https://forum.ansible.com/t/ansible-ssh-pass-parameter-with-salt-encrypt-value-of-ansible-user-password-makes-client-server-unreachable-on-playbook-run/25124/10 "2017-08-10T21:03:43Z")
Working with SSH keys and agents is considered a basic sysadmin skill and and a prerequisite for ansible, so if this turns out to be problematic then it's a good idea to get familiar with this first. This list isn't the right place for that, but the topic is thoroughly documented on numerous places on the internet. ---
**Author:** ![Lorenzo\_Farinas](https://avatars.discourse-cdn.com/v4/letter/l/a87d85/32.png) [@Lorenzo\_Farinas](https://forum.ansible.com/u/Lorenzo_Farinas)\ **Post date:** [August 11, 2017, 6:27pm UTC](https://forum.ansible.com/t/ansible-ssh-pass-parameter-with-salt-encrypt-value-of-ansible-user-password-makes-client-server-unreachable-on-playbook-run/25124/11 "2017-08-11T18:27:36Z")
I found a way to generate key pair using RSA on Ansible control machine, copied the public key to the client’s /.ssh/authorized\_keys. When I run a playbook, it prompts me for the password I used to protect the private key. I followed the SSH Agent Forwarding with Ansible notes by configuring the ssh\_args parameter in the /etc/ansible/ansible.cfg file and the SSH\_AUTH\_SOCK Defaults parameter in the /etc/sudoers file of the client; but I’m still getting prompted with the password for private key on playbook run. What’s the procedure to make the playbook run passwordless? - Thanks, Lorenzo ---
**Author:** ![Chris13](https://avatars.discourse-cdn.com/v4/letter/c/c5a1d2/32.png) [@Chris13](https://forum.ansible.com/u/Chris13)\ **Post date:** [August 15, 2017, 3:52pm UTC](https://forum.ansible.com/t/ansible-ssh-pass-parameter-with-salt-encrypt-value-of-ansible-user-password-makes-client-server-unreachable-on-playbook-run/25124/12 "2017-08-15T15:52:58Z")
There’s not much documentation on this procedure man. I tried to set it up and failed. However, I don’t have a Cert server so I tried using a SSL cert. Here are a couple of links I found that will give you some where to start. [https://github.com/ansible/ansible/issues/16243](https://github.com/ansible/ansible/issues/16243) [http://www.hurryupandwait.io/blog/certificate-password-less-based-authentication-in-winrm](http://www.hurryupandwait.io/blog/certificate-password-less-based-authentication-in-winrm) The directions are for a remote PS from Windows to Windows. The Ansible side is easy most of the setup is on the Windows Host…