# Ansible Vault - store credentials for all hosts in one vault file

**URL:** <https://forum.ansible.com/t/ansible-vault-store-credentials-for-all-hosts-in-one-vault-file/28841>\
**Category:** Ansible Project\
**Created:** [October 22, 2018, 7:57am UTC](https://forum.ansible.com/t/ansible-vault-store-credentials-for-all-hosts-in-one-vault-file/28841 "2018-10-22T07:57:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Libor\_Burda](https://avatars.discourse-cdn.com/v4/letter/l/b38774/32.png) [@Libor\_Burda](https://forum.ansible.com/u/Libor_Burda)\
**Post date:** [October 22, 2018, 7:57am UTC](https://forum.ansible.com/t/ansible-vault-store-credentials-for-all-hosts-in-one-vault-file/28841/1 "2018-10-22T07:57:43Z")

</div>

Hello everyone.

Is there any way how to store credentials in one Vault file, so that these credentials are applied for each host?

For example, when I create group\_vars/all.yml and store creds here and then execute playbook with --limit=single\_host, these credentials are not applied. I probably would have to create vault file for each host, but that’s crazy when you have thousands of servers.

The goal is to stop Ansible execution once you put wrong ssh password. Right now, Ansible tries to connect with wrong password, it fails, and our SIEM detects this as attack and locks the account instantly.

Or is there any alternative way how to prevent this from happening?

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![Tchia04](https://avatars.discourse-cdn.com/v4/letter/t/fbc32d/32.png) [@Tchia04](https://forum.ansible.com/u/Tchia04)\
**Post date:** [October 22, 2018, 4:24pm UTC](https://forum.ansible.com/t/ansible-vault-store-credentials-for-all-hosts-in-one-vault-file/28841/2 "2018-10-22T16:24:52Z")

</div>

You can try to add “serial: 1” to your play in your playbook so if it fails to ssh to first host, it won’t try to connect to the 2nd host.  
By default, it tries to connect 5 hosts at a time and usually that is enough to trigger the account to be locked.

Regards,  
Tony Chia

---

<div class="post-metadata">

**Author:** ![Michael\_M1](https://avatars.discourse-cdn.com/v4/letter/m/e274bd/32.png) [@Michael\_M1](https://forum.ansible.com/u/Michael_M1)\
**Post date:** [October 23, 2018, 1:48am UTC](https://forum.ansible.com/t/ansible-vault-store-credentials-for-all-hosts-in-one-vault-file/28841/3 "2018-10-23T01:48:38Z")

</div>

Libor,

I think what you are asking is if you can do something like this?

host1 password123  
host2 password456  
host3 password789

If so, then sure. Just put it in a tab-separated file and encrypt it with ansible-encrypt and use it like you would any other variables. You could probably use the csvfile module to call column 1 for user, column 2 for password.