# Ansible Vault - Issues with Encrypting ansible\_password

**URL:** <https://forum.ansible.com/t/ansible-vault-issues-with-encrypting-ansible-password/4412>\
**Category:** Get Help\
**Tags:** winrm, windows, ansible-vault, ansible\
**Created:** [March 17, 2024, 10:50am UTC](https://forum.ansible.com/t/ansible-vault-issues-with-encrypting-ansible-password/4412 "2024-03-17T10:50:00Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bibbi](https://avatars.discourse-cdn.com/v4/letter/b/db5fbb/32.png) [@Bibbi](https://forum.ansible.com/u/Bibbi)\
**Post date:** [March 17, 2024, 10:50am UTC](https://forum.ansible.com/t/ansible-vault-issues-with-encrypting-ansible-password/4412/1 "2024-03-17T10:50:00Z")

</div>

Hi everyone.  
I encounter an issue while attempting to encrypt the _ansible\_password_ using _ansible-vault_ for connecting to a Windows host with WinRM. Once the password is encrypted and inserted into the _vars/main.yaml_ file, the playbook fails to recognize it for connecting to the host.  
Here my playbook:

```auto
#test.yaml
---
- hosts: servers
  roles:
    - windows

```

inventory:

```auto
[servers]
IP

[servers:vars]
ansible_user=user
ansible_port=5985
ansible_connection=winrm
ansible_winrm_scheme=http
ansible_winrm_server_cert_validation=ignore
ansible_winrm_kerberos_delegation=true

```

vars:

```auto
---
ansible_password: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          66303033643362333834373963393231383533333635643334313739383361313238386162313261
          3639623339623335376534316636306133643066656130340a663166343932383632313234623561
          31323466393934613637313734353039363531366138383663333339333562626165623463356530
          6536363164343766300a316162336535656630376532323063333932366535356139386134666435
          63366330303439666139373166373366386161336636653036613438323565383936

```

ansible.cfg:

```auto
[defaults]
vault_password_file = root/open.txt

```

When executing _ansible-playbook -i inventory.ini test.yaml_, I encountered the following error:

_fatal: [ip]: UNREACHABLE! =\> { “changed”: false, “msg”: “ssl: auth method ssl requires a password”, “unreachable”: true }_

What could be the issue?

---

<div class="post-metadata">

**Author:** ![Dustin](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/dustin/32/2573_2.png) [@Dustin](https://forum.ansible.com/u/Dustin)\
**Post date:** [March 17, 2024, 11:04pm UTC](https://forum.ansible.com/t/ansible-vault-issues-with-encrypting-ansible-password/4412/2 "2024-03-17T23:04:02Z")

</div>

How are you telling ansible what the vault password is?  
According to [Ansible-Vault](https://docs.ansible.com/ansible/latest/vault_guide/vault_managing_passwords.html) and [Ansible Config Settings](https://docs.ansible.com/ansible/latest/reference_appendices/config.html) documentation, there are a couple different ways to tell Ansible what your vault password is.

For my local development stuff, I put my vault password into a text file and then set the `ANSIBLE_VAULT_PASSWORD_FILE` environment variable to that file location. That way, ansible knows where to find my ansible-vault password and can decrypt the vault to read the contents.

---

<div class="post-metadata">

**Author:** ![Bibbi](https://avatars.discourse-cdn.com/v4/letter/b/db5fbb/32.png) [@Bibbi](https://forum.ansible.com/u/Bibbi)\
**Post date:** [March 18, 2024, 10:32am UTC](https://forum.ansible.com/t/ansible-vault-issues-with-encrypting-ansible-password/4412/3 "2024-03-18T10:32:43Z")

</div>

I’ve configured the Vault password in ansible.cfg but it seems that Ansible isn’t picking up the `ansible_password` variable.

Upon running the playbook, I encounter the following error message:

`fatal: [IP]: UNREACHABLE! => {"changed": false, "msg": "plaintext: auth method plaintext requires a password", "unreachable": true }`

In an attempt to resolve this, I specified the location of `ansible_password` using `vars_file` :

```auto
- hosts: servers
  vars_file: 
      - /etc/ansible/roles/windows/vars/main.yaml
  roles:
    - windows

```

However, this resulted in another error:

`fatal: [IP]: UNREACHABLE! => { "changed": false, "msg": "plaintext: the specified credentials were rejected by the server", "unreachable": true }`

I dont get it.

---

<div class="post-metadata">

**Author:** ![Dustin](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/dustin/32/2573_2.png) [@Dustin](https://forum.ansible.com/u/Dustin)\
**Post date:** [March 18, 2024, 11:28am UTC](https://forum.ansible.com/t/ansible-vault-issues-with-encrypting-ansible-password/4412/4 "2024-03-18T11:28:33Z")

</div>

As a simple test to see if any of the special characters in your passwords are messing with the Ansible interpreters, try removing all special characters from the password.

If you must have a special character, use underscore “\_” or pound “#”. Those don’t have special meaning in most languages.

---

<div class="post-metadata">

**Author:** ![Bibbi](https://avatars.discourse-cdn.com/v4/letter/b/db5fbb/32.png) [@Bibbi](https://forum.ansible.com/u/Bibbi)\
**Post date:** [March 19, 2024, 11:51am UTC](https://forum.ansible.com/t/ansible-vault-issues-with-encrypting-ansible-password/4412/5 "2024-03-19T11:51:37Z")

</div>

I updated the _ansible\_winrm\_scheme_ setting from http to https, and now it functions properly. The issue lay within the WinRM configuration.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [April 18, 2024, 11:51am UTC](https://forum.ansible.com/t/ansible-vault-issues-with-encrypting-ansible-password/4412/6 "2024-04-18T11:51:44Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.