# Encrypted Password in Playbook **URL:** \ **Category:** Ansible Project\ **Created:** [January 21, 2020, 6:07am UTC](https://forum.ansible.com/t/encrypted-password-in-playbook/32016 "2020-01-21T06:07:21Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Srinivas\_Naram](https://avatars.discourse-cdn.com/v4/letter/s/eb9ed0/32.png) [@Srinivas\_Naram](https://forum.ansible.com/u/Srinivas_Naram)\ **Post date:** [January 21, 2020, 6:07am UTC](https://forum.ansible.com/t/encrypted-password-in-playbook/32016/1 "2020-01-21T06:07:21Z")
Hi All, I am trying to use Ansible vault encrypted password in my playbook and don’t see clear documentation on how to use it. Here is what I did so far - In ansible.cfg I have set the ‘vault\_password\_file’. I have all my playbooks in a directory called devplaybooks. I have created a sub-directory in devplaybooks directory with name ‘vault’ and executed following command ansible-vault create passwords Contents in passwords file : ansible\_password= secret123 In my inventory file I have created host vars `[:vars] ansible_user=root ansible_password=!vault` When I execute the playbook it throws up an error `TASK [Gathering Facts] **************************************************************************************** fatal: []: UNREACHABLE! => {"changed": false, "msg": "Invalid/incorrect username/password. Authentication failed.", "unreachable": true}` When I change the host vars to following the playbook is executing successfully ` [:vars] ansible\_user=root ansible\_password= secret123 ` Can you please help me figure out my mistake or point me to right documentation. How does my playbook know my password file ? ---
**Author:** ![vbotka](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/vbotka/32/359_2.png) [@vbotka](https://forum.ansible.com/u/vbotka)\ **Post date:** [January 21, 2020, 8:16am UTC](https://forum.ansible.com/t/encrypted-password-in-playbook/32016/2 "2020-01-21T08:16:58Z")
The encrypted value of the variable is missing. See "Use encrypt\_string to create encrypted variables to embed in yaml". [https://docs.ansible.com/ansible/latest/user\_guide/vault.html#use-encrypt-string-to-create-encrypted-variables-to-embed-in-yaml](https://docs.ansible.com/ansible/latest/user_guide/vault.html#use-encrypt-string-to-create-encrypted-variables-to-embed-in-yaml)   -vlado ---
**Author:** ![Srinivas\_Naram](https://avatars.discourse-cdn.com/v4/letter/s/eb9ed0/32.png) [@Srinivas\_Naram](https://forum.ansible.com/u/Srinivas_Naram)\ **Post date:** [January 21, 2020, 10:01am UTC](https://forum.ansible.com/t/encrypted-password-in-playbook/32016/3 "2020-01-21T10:01:33Z")
Hello Vladimir, Thanks for your reply. I am trying to maintain password (encrypted using ansible-vault) and my playbook (clear-text) in separate files. If I understand correctly the below URL is suggesting to encrypt the password string and copy the same in my playbook. [https://docs.ansible.com/ansible/latest/user\_guide/vault.html#use-encrypt-string-to-create-encrypted-variables-to-embed-in-yaml](https://docs.ansible.com/ansible/latest/user_guide/vault.html#use-encrypt-string-to-create-encrypted-variables-to-embed-in-yaml) Am I reading this correctly? Please help. ---
**Author:** ![racke](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/racke/32/4767_2.png) [@racke](https://forum.ansible.com/u/racke)\ **Post date:** [January 21, 2020, 10:10am UTC](https://forum.ansible.com/t/encrypted-password-in-playbook/32016/4 "2020-01-21T10:10:19Z")
> Hello Vladimir, > > Thanks for your reply. > > I am trying to maintain password (encrypted using ansible-vault) and my playbook (clear-text) in separate files. If I > understand correctly the below URL is suggesting to encrypt the password string and copy the same in my playbook. > > [https://docs.ansible.com/ansible/latest/user\_guide/vault.html#use-encrypt-string-to-create-encrypted-variables-to-embed-in-yaml](https://docs.ansible.com/ansible/latest/user_guide/vault.html#use-encrypt-string-to-create-encrypted-variables-to-embed-in-yaml) > > Am I reading this correctly? Please help. You can definitely include encrypted\_variables in your inventory files, but you need to use YAML syntax. Regards          Racke ---
**Author:** ![vbotka](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/vbotka/32/359_2.png) [@vbotka](https://forum.ansible.com/u/vbotka)\ **Post date:** [January 21, 2020, 11:18am UTC](https://forum.ansible.com/t/encrypted-password-in-playbook/32016/5 "2020-01-21T11:18:05Z")
Below is a step-by-step scenario: 1) Let's assume the vault password has bee configured properly (you have set the 'vault\_password\_file' in ansible.cfg) . Let's use global variable here. For example   $ set | grep VAULT   ANSIBLE\_VAULT\_PASSWORD\_FILE=/home/admin/.vault\_pass.txt See "Providing Vault Passwords" [https://docs.ansible.com/ansible/latest/user\_guide/vault.html#providing-vault-passwords](https://docs.ansible.com/ansible/latest/user_guide/vault.html#providing-vault-passwords) 2) Create a file foo.yml with variable(s). Encrypt the file. See the content.   $ cat foo.yml   test\_var1: secret   $ ansible-vault encrypt foo.yml   $ cat foo.yml   $ANSIBLE\_VAULT;1.1;AES256   39333766363735373133663263613063313331326263373433353434653566663439623366373338   6438306562323262363965653336653362616136366439620a326533316463346437373066333433   30353336623733303762613639636138336666366631386531633064323733313936663831393731   3036633964323235310a613766346633613765643832306539346137613731663865636564636164   61303534393363616263666564636366303861623131306536316432383230393736   $ ansible-vault view foo.yml   test\_var1: secret1 See "Encrypting Unencrypted Files" [https://docs.ansible.com/ansible/latest/user\_guide/vault.html#encrypting-unencrypted-files](https://docs.ansible.com/ansible/latest/user_guide/vault.html#encrypting-unencrypted-files) 3) Create inventory (fit the groups and hosts to your needs)   $ cat hosts   [test]   test\_01 4) Put the encrypted file into the directory host\_vars (fit the host to your needs)   $ mkdir -p host\_vars/test\_01   $ mv foo.yml host\_vars/test\_01/ 5) Create and run playbook. See the variable was successfully decrypted.   $ cat test.yml   - hosts: test\_01     tasks:     - debug:         var: test\_var1   $ ansible-playbook test1.yml   ok: [test\_01] =\> { "test\_var1": "secret1" } There are many variations how-to handle vault variables. If you have troubles report minimal, complete, reproducible example. HTH,   -vlado ---
**Author:** ![Srinivas\_Naram](https://avatars.discourse-cdn.com/v4/letter/s/eb9ed0/32.png) [@Srinivas\_Naram](https://forum.ansible.com/u/Srinivas_Naram)\ **Post date:** [January 21, 2020, 2:35pm UTC](https://forum.ansible.com/t/encrypted-password-in-playbook/32016/6 "2020-01-21T14:35:15Z")
Hello Vladimir I have followed exactly same steps mentioned above and I see different errors now. My steps - Set the Ansible Vault password file Env variable - Create the vault encrypted file - Create directories and copy files in specific location. My dir structure playbooks > - vault > -testing.yml > -host\_vars > - 192.168.249.107 > - test.yml I get following error Error - ERROR! failed to combine variables, expected dicts but got a ‘dict’ and a ‘AnsibleUnicode’:{} “testing123:sensitive” When I change the directory structure in host\_vars to groupname playbooks > - vault > -testing.yml > -host\_vars > - ansible\_enddevice\_2 > - test.yml I get different message ok: [192.168.249.107] =\> { “testing123”: “VARIABLE IS NOT DEFINED!” } My inventory file structure [ansible\_enddevice\_2] 192.168.249.107 ---
**Author:** ![Srinivas\_Naram](https://avatars.discourse-cdn.com/v4/letter/s/eb9ed0/32.png) [@Srinivas\_Naram](https://forum.ansible.com/u/Srinivas_Naram)\ **Post date:** [January 22, 2020, 4:13am UTC](https://forum.ansible.com/t/encrypted-password-in-playbook/32016/7 "2020-01-22T04:13:55Z")
Any suggestions would be greatly appreciated. ---
**Author:** ![Srinivas\_Naram](https://avatars.discourse-cdn.com/v4/letter/s/eb9ed0/32.png) [@Srinivas\_Naram](https://forum.ansible.com/u/Srinivas_Naram)\ **Post date:** [January 23, 2020, 8:49am UTC](https://forum.ansible.com/t/encrypted-password-in-playbook/32016/8 "2020-01-23T08:49:02Z")
Suggestions please. ---
**Author:** ![Srinivas\_Naram](https://avatars.discourse-cdn.com/v4/letter/s/eb9ed0/32.png) [@Srinivas\_Naram](https://forum.ansible.com/u/Srinivas_Naram)\ **Post date:** [January 24, 2020, 11:51am UTC](https://forum.ansible.com/t/encrypted-password-in-playbook/32016/9 "2020-01-24T11:51:39Z")
Ok, I found the solution myself. Group or host variables should have different directory. There is no need of explicit mention such as in the playbook, but create a directory called group\_vars or host\_vars in the directory where the playbook is placed. these directories will have files with variables you want to define. File structure should be in yml format.