# ansible vault with ad hoc command line **URL:** \ **Category:** Ansible Project\ **Created:** [October 29, 2018, 1:00pm UTC](https://forum.ansible.com/t/ansible-vault-with-ad-hoc-command-line/28889 "2018-10-29T13:00:36Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![rajendra.rawat17](https://avatars.discourse-cdn.com/v4/letter/r/e47774/32.png) [@rajendra.rawat17](https://forum.ansible.com/u/rajendra.rawat17)\ **Post date:** [October 29, 2018, 1:00pm UTC](https://forum.ansible.com/t/ansible-vault-with-ad-hoc-command-line/28889/1 "2018-10-29T13:00:36Z")
Hi All, Is it possible to use ansible-vault with ad-hoc commands. Use case: I have not setup ssh key and I want to use ping module on target machine. normal way if we have setup sshkey or pass the text password 1: ansible \ -m ping [if ssh key configured] 2: ansible \ -m ping --extra-vars “ansible\_user= ansible\_password=” But I want to do this with ansible-vault. Is it possible ? any help would be appreciated. ---
**Author:** ![Andrew\_Latham](https://avatars.discourse-cdn.com/v4/letter/a/ed8c4c/32.png) [@Andrew\_Latham](https://forum.ansible.com/u/Andrew_Latham)\ **Post date:** [October 29, 2018, 3:47pm UTC](https://forum.ansible.com/t/ansible-vault-with-ad-hoc-command-line/28889/2 "2018-10-29T15:47:12Z")
Try something like… ansible --vault-id ~/.vault -e @ yourvault.yml This will expose the variables for your use, like in your inventory ansible\_become: true ansible\_become\_method: su ansible\_become\_user: root ansible\_become\_pass: “{{ var\_from\_vault }}” inventory example [https://lathama.net/git/lathama/IaC/src/branch/master/Infrastructure/inventory.yml](https://lathama.net/git/lathama/IaC/src/branch/master/Infrastructure/inventory.yml) How I do this with playbooks [https://lathama.net/git/lathama/IaC/src/branch/master/Infrastructure](https://lathama.net/git/lathama/IaC/src/branch/master/Infrastructure) ---
**Author:** ![Foss\_Geek](https://avatars.discourse-cdn.com/v4/letter/f/df705f/32.png) [@Foss\_Geek](https://forum.ansible.com/u/Foss_Geek)\ **Post date:** [October 29, 2018, 3:49pm UTC](https://forum.ansible.com/t/ansible-vault-with-ad-hoc-command-line/28889/3 "2018-10-29T15:49:47Z")
Do you have any problem using vault with ad-hoc?? Here is a example of how it works. I have a vault secret file under group\_vars like below. You have to use ansible-vault create. # ansible-vault view group\_vars/myserver.yml Vault password: ---
**Author:** ![rajendra.rawat17](https://avatars.discourse-cdn.com/v4/letter/r/e47774/32.png) [@rajendra.rawat17](https://forum.ansible.com/u/rajendra.rawat17)\ **Post date:** [October 29, 2018, 7:33pm UTC](https://forum.ansible.com/t/ansible-vault-with-ad-hoc-command-line/28889/4 "2018-10-29T19:33:42Z")
Hi Mohan, I tried running ad-hoc command as you suggested but it is not working ansible \ -m ping -u \ --vault-password-file \ where “secret\_file” was created with password of \ ansible-vault create secret\_file cat secret\_file Output: [WARNING]: Error in vault password file loading (default): A vault password must be specified to decrypt data ERROR! A vault password must be specified to decrypt data Am i doing something wrong? ---
**Author:** ![Foss\_Geek](https://avatars.discourse-cdn.com/v4/letter/f/df705f/32.png) [@Foss\_Geek](https://forum.ansible.com/u/Foss_Geek)\ **Post date:** [October 30, 2018, 2:51am UTC](https://forum.ansible.com/t/ansible-vault-with-ad-hoc-command-line/28889/5 "2018-10-30T02:51:33Z")
You have to pass vault password to ansible command not vault file itself. Vault file stores your secrets/variables in encrypted format and vault password is used decrypt it. Pass vault password to ansible command. You have read this doc: [https://docs.ansible.com/ansible/2.7/user\_guide/vault.html](https://docs.ansible.com/ansible/2.7/user_guide/vault.html) Take a look at the below link as well: [https://serversforhackers.com/c/how-ansible-vault-works](https://serversforhackers.com/c/how-ansible-vault-works) [https://zaiste.net/ansible\_vault\_storing\_sensitive\_data\_as\_encrypted\_variables/](https://zaiste.net/ansible_vault_storing_sensitive_data_as_encrypted_variables/) If your roles or playbooks reference encrypted variables, you need to have give Ansible the password to decrypt them. Prior Ansible 2.4, You can do this in two ways: 1). Using the --ask-vault-pass flag will instruct Ansible to ask for the vault password so it can decrypt the variable files correctly. 2). Using —vault-password-file flag will instruct Ansible to reference vault password from file. Ansible playbook use the password with in the reference file to decrypt vault file. Since Ansible 2.4, there is way to provide a vault password is to use the --vault-id option as well. This allow vault files or vars that are encrypted with different passwords can be used at the same time. If your roles or playbooks reference encrypted variables, you need to have give Ansible the password to decrypt them. Prior Ansible 2.4, You can do this in two ways: 1). Using the --ask-vault-pass flag will instruct Ansible to ask for the vault password so it can decrypt the variable files correctly. 2). Using —vault-password-file flag will instruct Ansible to reference vault password from file. Ansible playbook use the password with in the reference file to decrypt vault file. Since Ansible 2.4, there is way to provide a vault password is to use the --vault-id option as well. This allow vault files or vars that are encrypted with different passwords can be used at the same time. That what Andrew was mentioned on his post. ---
**Author:** ![rajendra.rawat17](https://avatars.discourse-cdn.com/v4/letter/r/e47774/32.png) [@rajendra.rawat17](https://forum.ansible.com/u/rajendra.rawat17)\ **Post date:** [October 30, 2018, 6:09am UTC](https://forum.ansible.com/t/ansible-vault-with-ad-hoc-command-line/28889/6 "2018-10-30T06:09:26Z")
I have gone through the link shared by you but there is no where is it using the vault for ad hoc command. It is using it for playbook. Request you to please share a example of ping module as I did in my previous email that would be helpful understanding it. ad-hoc command: ansible \ -m ping \ Please note sshkey is not setup on target host. Thanks & Regards Rajendra Rawat ---
**Author:** ![Foss\_Geek](https://avatars.discourse-cdn.com/v4/letter/f/df705f/32.png) [@Foss\_Geek](https://forum.ansible.com/u/Foss_Geek)\ **Post date:** [October 30, 2018, 11:36am UTC](https://forum.ansible.com/t/ansible-vault-with-ad-hoc-command-line/28889/7 "2018-10-30T11:36:46Z")
I have already given you example. You can see If you closely read my first replay to this thread. Ansible vault works the same way for both ansible-playbook and ansible command. What ever documented for ansible-playbook also work with ansible ad hoc if you use vault. You have spend some time to learn it. Every thing documented well. Here is the step by step example: 1). Create a directory group\_vars ` # mkdir -p /etc/ansible/group\_vars ` 2). Create a variable file with your server user name and password. Please note this is the username and password which your ansible ad hoc command going to use to login to your target machine. ` # vim /etc/ansible/group\_vars/myservers.yml ` ` ---
**Author:** ![rajendra.rawat17](https://avatars.discourse-cdn.com/v4/letter/r/e47774/32.png) [@rajendra.rawat17](https://forum.ansible.com/u/rajendra.rawat17)\ **Post date:** [October 31, 2018, 6:22am UTC](https://forum.ansible.com/t/ansible-vault-with-ad-hoc-command-line/28889/8 "2018-10-31T06:22:05Z")
It is working for me now. thanks for the explaining it in detailed. it is working for for me after creating the group into /etc/ansible/group\_var I have a doubt, can we achieve the same functionality without creating vault file with same group name which we given in inventory file into /etc/ansible/group\_var/? ---
**Author:** ![Foss\_Geek](https://avatars.discourse-cdn.com/v4/letter/f/df705f/32.png) [@Foss\_Geek](https://forum.ansible.com/u/Foss_Geek)\ **Post date:** [October 31, 2018, 8:07am UTC](https://forum.ansible.com/t/ansible-vault-with-ad-hoc-command-line/28889/9 "2018-10-31T08:07:04Z")
You can create a directory called ‘all’ under your playbook group\_vars directory and use ‘all’ in your ad hoc command. This way the variables applied to all the host defined in myhostfile in my example. # tree -L 3 /etc/ansible/group\_vars /etc/ansible/group\_vars `-- all `-- secrets.yml # ansible -i /etc/ansible/myhostfile all -m file -a “dest=/tmp/hello mode=755 state=directory” -u root --ask-vault-pass Vault password: localhost | SUCCESS =\> { “changed”: false, “gid”: 0, “group”: “root”, “mode”: “0755”, “owner”: “root”, “path”: “/tmp/hello”, “secontext”: “unconfined\_u:object\_r:user\_tmp\_t:s0”, “size”: 6, “state”: “directory”, “uid”: 0 } Have a look at ansible inventory: [https://docs.ansible.com/ansible/latest/user\_guide/intro\_inventory.html](https://docs.ansible.com/ansible/latest/user_guide/intro_inventory.html) **[How to Manage Multistage Environments with Ansible | DigitalOcean](https://www.digitalocean.com/community/tutorials/how-to-manage-multistage-environments-with-ansible#ansible-recommended-strategy-using-groups-and-multiple-inventories)** ---
**Author:** ![rajendra.rawat17](https://avatars.discourse-cdn.com/v4/letter/r/e47774/32.png) [@rajendra.rawat17](https://forum.ansible.com/u/rajendra.rawat17)\ **Post date:** [November 1, 2018, 4:49am UTC](https://forum.ansible.com/t/ansible-vault-with-ad-hoc-command-line/28889/10 "2018-11-01T04:49:20Z")
Thanks a lot Mohan for your help.