# Connection password precedence and command line options

**URL:** <https://forum.ansible.com/t/connection-password-precedence-and-command-line-options/20730>\
**Category:** Ansible Developer\
**Created:** [March 1, 2016, 7:35pm UTC](https://forum.ansible.com/t/connection-password-precedence-and-command-line-options/20730 "2016-03-01T19:35:56Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![marc.petrivelli](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/marc.petrivelli/32/3773_2.png) [@marc.petrivelli](https://forum.ansible.com/u/marc.petrivelli)\
**Post date:** [March 1, 2016, 7:35pm UTC](https://forum.ansible.com/t/connection-password-precedence-and-command-line-options/20730/1 "2016-03-01T19:35:56Z")

</div>

I am running off the stable-1.9 branch.

I have an vault password file that is part of the inventory. I use the variables from that file to populate **ansible\_ssh\_pass** in the appropriate group\_vars/group file. So for example we have a **win\_pass** variable in the vault file and then in the group\_vars/windows\_servers we have "ansible\_ssh\_pass: ‘{{win\_pass}}’. This effectively get the right password to each host. What I want to do is to override ansible\_ssh\_pass using the ansible/ansible-playbook -k flag. I would expect this flag to take precedence over inventory defined password information. Currently if the **ansible\_ssh\_pass** variable is set the -k flag is ignored.

Does anyone know the expected behavior in this situation?

We are using password auth to do initial config on the machine before pushing out a public key to the hosts so please refrain from the “you really should be using key authentication” comments.

Thanks in advance  
–Marc