# Encrypted SSH Key leads to Invalid format **URL:** \ **Category:** Ansible Project\ **Created:** [October 2, 2022, 11:15am UTC](https://forum.ansible.com/t/encrypted-ssh-key-leads-to-invalid-format/37166 "2022-10-02T11:15:33Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Jeremie\_Levy](https://avatars.discourse-cdn.com/v4/letter/j/e95f7d/32.png) [@Jeremie\_Levy](https://forum.ansible.com/u/Jeremie_Levy)\ **Post date:** [October 2, 2022, 11:15am UTC](https://forum.ansible.com/t/encrypted-ssh-key-leads-to-invalid-format/37166/1 "2022-10-02T11:15:33Z")
I’m using in inventory/group\_vars/all.yaml: … **ansible\_ssh\_private\_key\_file: ‘{{inventory\_dir}}/group\_vars/path/to/key’** This Key is working well when it’s plain text When I encrypt the file with ansible-vault, i get the error: **Load key “/home/user/projects/ansible/inventory/group\_vars/path/to/key”: invalid format** **root @ SOME\_IP: Permission denied (publickey,password).** **unreachable: true** I am using $ **ANSIBLE\_VAULT\_PASSWORD\_FILE** to decrypt everything without asking for password. I have other encrypted secrets in all.yaml that get decrypted. What am I missing ? Thanks! ---
**Author:** ![Evan\_Hisey](https://avatars.discourse-cdn.com/v4/letter/e/ce73a5/32.png) [@Evan\_Hisey](https://forum.ansible.com/u/Evan_Hisey)\ **Post date:** [October 2, 2022, 6:02pm UTC](https://forum.ansible.com/t/encrypted-ssh-key-leads-to-invalid-format/37166/2 "2022-10-02T18:02:03Z")
Can you confirm the decrypted key is valid by direct ssh? Hard to tell for sure but that looks like the target host is rejecting the key format. Not all key formats are accepted by all targets. I have run in to this with Github and Tenable Scanners. ---
**Author:** ![Jeremie\_Levy](https://avatars.discourse-cdn.com/v4/letter/j/e95f7d/32.png) [@Jeremie\_Levy](https://forum.ansible.com/u/Jeremie_Levy)\ **Post date:** [October 2, 2022, 6:04pm UTC](https://forum.ansible.com/t/encrypted-ssh-key-leads-to-invalid-format/37166/3 "2022-10-02T18:04:14Z")
Yes it works, and it works unencrypted. ---
**Author:** ![dan\_linder](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/dan_linder/32/3833_2.png) [@dan\_linder](https://forum.ansible.com/u/dan_linder)\ **Post date:** [October 2, 2022, 8:02pm UTC](https://forum.ansible.com/t/encrypted-ssh-key-leads-to-invalid-format/37166/4 "2022-10-02T20:02:50Z")
Can you provide a minimal Ansible playbook with a vaulted variable file to see if we can recreate it or see anything amiss? The error message you’re showing states “root @ SOME\_IP: Permission denied (publickey,password)” which doesn’t seem to be ansible-vault related. ---
**Author:** ![Jeremie\_Levy](https://avatars.discourse-cdn.com/v4/letter/j/e95f7d/32.png) [@Jeremie\_Levy](https://forum.ansible.com/u/Jeremie_Levy)\ **Post date:** [October 3, 2022, 8:41am UTC](https://forum.ansible.com/t/encrypted-ssh-key-leads-to-invalid-format/37166/5 "2022-10-03T08:41:01Z")
Hmm, it seems it’s not an ansible issue, when i decrypt the key and try it works. Then encrypting the key, it still works. After few minutes, it stop working… From ansible on ubuntu 18.04 (python 3.6) to target 20.04 #: ansible --version [DEPRECATION WARNING]: Ansible will require Python 3.8 or newer on the controller starting with Ansible 2.12. Current version: 3.6.9 (default, Jun 29 2022, 11:45:57) [GCC 8.4.0]. This feature will be removed from ansible-core in version 2.12. Deprecation warnings can be disabled by setting deprecation\_warnings=False in ansible.cfg. /home/user/.local/lib/python3.6/site-packages/ansible/parsing/vault/ **init**.py:44: CryptographyDeprecationWarning: Python 3.6 is no longer supported by the Python core team. Therefore, support for it is deprecated in cryptography and will be removed in a future release. from cryptography.exceptions import InvalidSignature ansible [core 2.11.12] config file = /home/user/projects/ansible/ansible.cfg configured module search path = [‘/home/user/.ansible/plugins/modules’, ‘/usr/share/ansible/plugins/modules’] ansible python module location = /home/user/.local/lib/python3.6/site-packages/ansible ansible collection location = /home/user/.ansible/collections:/usr/share/ansible/collections executable location = /home/user/.local/bin/ansible python version = 3.6.9 (default, Jun 29 2022, 11:45:57) [GCC 8.4.0] jinja version = 3.0.3 libyaml = True ---
**Author:** ![Walter\_Rowe](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/walter_rowe/32/4506_2.png) [@Walter\_Rowe](https://forum.ansible.com/u/Walter_Rowe)\ **Post date:** [October 3, 2022, 11:07am UTC](https://forum.ansible.com/t/encrypted-ssh-key-leads-to-invalid-format/37166/6 "2022-10-03T11:07:57Z")
Is your version of ansible / ansible-vault support on Ubuntu 18.04? Walter ---
**Author:** ![dnmvisser](https://avatars.discourse-cdn.com/v4/letter/d/8e8cbc/32.png) [@dnmvisser](https://forum.ansible.com/u/dnmvisser)\ **Post date:** [October 3, 2022, 11:51am UTC](https://forum.ansible.com/t/encrypted-ssh-key-leads-to-invalid-format/37166/7 "2022-10-03T11:51:56Z")
This sounds like the key is cached by some agent. Investigate that. ---
**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\ **Post date:** [October 3, 2022, 12:00pm UTC](https://forum.ansible.com/t/encrypted-ssh-key-leads-to-invalid-format/37166/8 "2022-10-03T12:00:53Z")
I don’t think what you’re doing is expected to work. **ansible\_ssh\_private\_key\_file** is the path to a private key file used by ssh. That you happen to point it at a file in **{{inventory\_dir}}/group\_vars** doesn’t somehow make ssh able to decrypt ansible-vault encrypted files. ---
**Author:** ![dnmvisser](https://avatars.discourse-cdn.com/v4/letter/d/8e8cbc/32.png) [@dnmvisser](https://forum.ansible.com/u/dnmvisser)\ **Post date:** [October 3, 2022, 12:10pm UTC](https://forum.ansible.com/t/encrypted-ssh-key-leads-to-invalid-format/37166/9 "2022-10-03T12:10:42Z")
See also [https://github.com/ansible/ansible/issues/22382](https://github.com/ansible/ansible/issues/22382) ---
**Author:** ![Jeremie\_Levy](https://avatars.discourse-cdn.com/v4/letter/j/e95f7d/32.png) [@Jeremie\_Levy](https://forum.ansible.com/u/Jeremie_Levy)\ **Post date:** [October 18, 2022, 8:02am UTC](https://forum.ansible.com/t/encrypted-ssh-key-leads-to-invalid-format/37166/10 "2022-10-18T08:02:20Z")
So what is the right approach to secure ssh private key ? ---
**Author:** ![dnmvisser](https://avatars.discourse-cdn.com/v4/letter/d/8e8cbc/32.png) [@dnmvisser](https://forum.ansible.com/u/dnmvisser)\ **Post date:** [October 18, 2022, 8:38am UTC](https://forum.ansible.com/t/encrypted-ssh-key-leads-to-invalid-format/37166/11 "2022-10-18T08:38:24Z")
That depends entirely on your situation and its security requirements. This can mean anything, from not encrypting anything, to fancy HSMs, etc. In any case, it's not something specific to ansible I would say. Dick