# file in vault (ssh private key) **URL:** \ **Category:** Ansible Project\ **Created:** [March 5, 2014, 4:24pm UTC](https://forum.ansible.com/t/file-in-vault-ssh-private-key/14709 "2014-03-05T16:24:28Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Jeremy\_Schneider](https://avatars.discourse-cdn.com/v4/letter/j/d2c977/32.png) [@Jeremy\_Schneider](https://forum.ansible.com/u/Jeremy_Schneider)\ **Post date:** [March 5, 2014, 4:24pm UTC](https://forum.ansible.com/t/file-in-vault-ssh-private-key/14709/1 "2014-03-05T16:24:28Z")
reading through vault docs, appears that it’s designed to store variable contents. maybe this should be obvious to me but it isn’t - so maybe someone can point me in the right direction. recommendation for the best way to store a file in vault? my particular use case is an SSH private key file (password-less, used to enable jumping between servers in a cluster). normally i’d stick this in the files folder and use the copy module to push it. -Jeremy ---
**Author:** ![bryan\_hunt1](https://avatars.discourse-cdn.com/v4/letter/b/ed8c4c/32.png) [@bryan\_hunt1](https://forum.ansible.com/u/bryan_hunt1)\ **Post date:** [March 5, 2014, 4:59pm UTC](https://forum.ansible.com/t/file-in-vault-ssh-private-key/14709/2 "2014-03-05T16:59:43Z")
Jeremy, I’d have suggested using SSH agent forwarding. If it worked. This is a classic example of where it should be used. Bryan ---
**Author:** ![Jeremy\_Schneider](https://avatars.discourse-cdn.com/v4/letter/j/d2c977/32.png) [@Jeremy\_Schneider](https://forum.ansible.com/u/Jeremy_Schneider)\ **Post date:** [March 5, 2014, 5:11pm UTC](https://forum.ansible.com/t/file-in-vault-ssh-private-key/14709/3 "2014-03-05T17:11:50Z")
we do use agent port forwarding for administrators. however there is a separate requirement for each cluster to have it’s own passwordless private key that is used for some other tasks within the cluster. -J ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [March 5, 2014, 8:15pm UTC](https://forum.ansible.com/t/file-in-vault-ssh-private-key/14709/4 "2014-03-05T20:15:39Z")
Yes it is for variable files of all sorts and can also be used on task files or handlers – anything YAML or JSON – Michael ---
**Author:** ![jpmens1](https://avatars.discourse-cdn.com/v4/letter/j/e9c0ed/32.png) [@jpmens1](https://forum.ansible.com/u/jpmens1)\ **Post date:** [March 5, 2014, 8:25pm UTC](https://forum.ansible.com/t/file-in-vault-ssh-private-key/14709/5 "2014-03-05T20:25:55Z")
> my particular use case is an SSH private key file (password-less, used to > enable jumping between servers in a cluster). normally i'd stick this in > the files folder and use the copy module to push it. A bit convoluted maybe, but base64-encode the file, and add it to a YAML vars file which is then put into ansible-vault? $ echo "myfile: $(openssl enc -a -A -in filename)" \> vars.yml myfile: aGVsbG8Kd29ybGQKaGVsbG8Kd29ybGQKaGVsbG8Kd29ybGQKaGVsbG8Kd29ybGQKaGVsbG8Kd29ybGQK         -JP ---
**Author:** ![Jeremy\_Schneider](https://avatars.discourse-cdn.com/v4/letter/j/d2c977/32.png) [@Jeremy\_Schneider](https://forum.ansible.com/u/Jeremy_Schneider)\ **Post date:** [March 5, 2014, 8:38pm UTC](https://forum.ansible.com/t/file-in-vault-ssh-private-key/14709/6 "2014-03-05T20:38:44Z")
i believe that openssh private key files are already text encoded; it looks this way on my servers. this approach had occurred to me also - but can I write a simple, elegant task to get this variable into the file on the hosts? that’s the part that wasn’t obvious to me. ---
**Author:** ![jpmens1](https://avatars.discourse-cdn.com/v4/letter/j/e9c0ed/32.png) [@jpmens1](https://forum.ansible.com/u/jpmens1)\ **Post date:** [March 5, 2014, 9:45pm UTC](https://forum.ansible.com/t/file-in-vault-ssh-private-key/14709/7 "2014-03-05T21:45:16Z")
> i believe that openssh private key files are already text encoded; it looks > this way on my servers. this approach had occurred to me also - but can I > write a simple, elegant task to get this variable into the file on the > hosts? that's the part that wasn't obvious to me. They are text-encoded, but not as a single line, which my version does; it looks better to me in a vars file, though you may be able to shoehorn multiline strings into YAML. 🙂 As for extraction, maybe the following could work (untested!) It decodes the base64-encoded string (-d) and writes it to the specified destination. - action: shell echo "{{ myfile }}" | openssl enc -d -a -out {{ destfile }}         -JP ---
**Author:** ![Brian\_Coca1](https://avatars.discourse-cdn.com/v4/letter/b/278dde/32.png) [@Brian\_Coca1](https://forum.ansible.com/u/Brian_Coca1)\ **Post date:** [March 5, 2014, 9:47pm UTC](https://forum.ansible.com/t/file-in-vault-ssh-private-key/14709/8 "2014-03-05T21:47:39Z")
why not encrypt the file itself? ansible-vault shoudl be able to handle it. ---
**Author:** ![Jeremy\_Schneider](https://avatars.discourse-cdn.com/v4/letter/j/d2c977/32.png) [@Jeremy\_Schneider](https://forum.ansible.com/u/Jeremy_Schneider)\ **Post date:** [March 5, 2014, 10:10pm UTC](https://forum.ansible.com/t/file-in-vault-ssh-private-key/14709/9 "2014-03-05T22:10:30Z")
> why not encrypt the file itself? ansible-vault should be able to handle it. I thought ansible-vault could only encrypt yaml and json files? ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [March 5, 2014, 10:50pm UTC](https://forum.ansible.com/t/file-in-vault-ssh-private-key/14709/10 "2014-03-05T22:50:39Z")
It can encrypt more but ansible (not the vault CLI) itself will only decrypt data files. It’s not really meant for arbitrary files. – Michael ---
**Author:** ![Stan\_Hu](https://avatars.discourse-cdn.com/v4/letter/s/c0e974/32.png) [@Stan\_Hu](https://forum.ansible.com/u/Stan_Hu)\ **Post date:** [March 5, 2014, 11:14pm UTC](https://forum.ansible.com/t/file-in-vault-ssh-private-key/14709/11 "2014-03-05T23:14:47Z")
Is there a reason why the file modules shouldn’t be modified to decrypt data with the vault password? Jeremy, I don’t see an elegant way to do what you want right now. I’ve resorted to importing a key file as an encrypted configuration variable and then using the ‘echo’ command to write it out until there is a better way. ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [March 6, 2014, 4:05pm UTC](https://forum.ansible.com/t/file-in-vault-ssh-private-key/14709/12 "2014-03-06T16:05:16Z")
I’m not against teaching the copy/template module to support encrypted sources. VaultLib is pretty abstract at this point so this would be an easy addition. –Michael ---
**Author:** ![bryan\_hunt1](https://avatars.discourse-cdn.com/v4/letter/b/ed8c4c/32.png) [@bryan\_hunt1](https://forum.ansible.com/u/bryan_hunt1)\ **Post date:** [March 28, 2014, 12:25pm UTC](https://forum.ansible.com/t/file-in-vault-ssh-private-key/14709/13 "2014-03-28T12:25:45Z")
I’d like to take this back, ssh agent forwarding does work. I have discovered that it only fails when used by the git module. Running commands which use ssh from Ansible does work.