# Get sudo/vault pass from stdin

**URL:** <https://forum.ansible.com/t/get-sudo-vault-pass-from-stdin/16173>\
**Category:** Ansible Developer\
**Tags:** galaxy-ng\
**Created:** [September 10, 2014, 2:00pm UTC](https://forum.ansible.com/t/get-sudo-vault-pass-from-stdin/16173 "2014-09-10T14:00:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nate\_Coraor](https://avatars.discourse-cdn.com/v4/letter/n/7bcc69/32.png) [@Nate\_Coraor](https://forum.ansible.com/u/Nate_Coraor)\
**Post date:** [September 10, 2014, 2:00pm UTC](https://forum.ansible.com/t/get-sudo-vault-pass-from-stdin/16173/1 "2014-09-10T14:00:12Z")

</div>

Moving the discussion over from Twitter: [https://twitter.com/natefoo/status/509540916932014080](https://twitter.com/natefoo/status/509540916932014080)

I have my vault passwords in pass ([http://www.passwordstore.org/](http://www.passwordstore.org/)), so to run a playbook that requires vault decryption, I’ll do something like:

`% pass -c ansible/vault/usegalaxy Copied ansible/vault/usegalaxy to clipboard. Will clear in 45 seconds. % ansible-playbook -i stage/inventory galaxy.yml --ask-vault-pass Vault password:`

At the prompt, paste, return, and the playbook runs. But if I’m going to run the playbook a lot, this process becomes tedious. What I’d like to be able to do is something like:

`  
% pass ansible/vault/usegalaxy | ansible-playbook -i stage/inventory galaxy.yml --vault-password-file=/dev/stdin

`

This doesn’t work because the --vault-password-file code expects the named file to be a real file, rather than a pipe.

Instead of the --vault-password-stdin option as I proposed on Twitter, would a PR be accepted to make --vault-password-file handle stdin as I was originally trying? I’d propose accepting any of (‘/dev/stdin’, ‘stdin’, ‘-’) to mean the same.

Thanks,  
–nate

---

<div class="post-metadata">

**Author:** ![sivel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sivel/32/1198_2.png) [@sivel](https://forum.ansible.com/u/sivel)\
**Post date:** [September 11, 2014, 5:18pm UTC](https://forum.ansible.com/t/get-sudo-vault-pass-from-stdin/16173/2 "2014-09-11T17:18:42Z")

</div>

Why not just create a script to be used with --vault-password-file that does something like:

#!/usr/bin/env python  
import sys  
sys.stdout.write(sys.stdin.read().strip())

This should handle what you are attempting.

---

<div class="post-metadata">

**Author:** ![Nate\_Coraor](https://avatars.discourse-cdn.com/v4/letter/n/7bcc69/32.png) [@Nate\_Coraor](https://forum.ansible.com/u/Nate_Coraor)\
**Post date:** [September 11, 2014, 6:14pm UTC](https://forum.ansible.com/t/get-sudo-vault-pass-from-stdin/16173/3 "2014-09-11T18:14:05Z")

</div>

Hi Matt,

Thanks for the idea, I actually already have a handy utility on my system that does what your script does. 😉

% pass ansible/vault/usegalaxy | ansible-playbook -i stage/inventory galaxy.yml --vault-password-file=/bin/cat

I didn’t realize that --vault-password-file could be a script (although the call to `is_executable` in the traceback should have tipped me off…).

–nate

---

<div class="post-metadata">

**Author:** ![Steven\_Wolfe](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@Steven\_Wolfe](https://forum.ansible.com/u/Steven_Wolfe)\
**Post date:** [December 3, 2015, 5:48pm UTC](https://forum.ansible.com/t/get-sudo-vault-pass-from-stdin/16173/4 "2015-12-03T17:48:23Z")

</div>

Thanks for the posts. This discussion was very helpful. Solved an issue I was having.