# how to encrypt ssh\_pass password without asking any more password **URL:** \ **Category:** Ansible Project\ **Created:** [December 14, 2023, 7:41am UTC](https://forum.ansible.com/t/how-to-encrypt-ssh-pass-password-without-asking-any-more-password/38626 "2023-12-14T07:41:41Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Sameer\_Modak](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sameer_modak/32/5180_2.png) [@Sameer\_Modak](https://forum.ansible.com/u/Sameer_Modak)\ **Post date:** [December 14, 2023, 7:41am UTC](https://forum.ansible.com/t/how-to-encrypt-ssh-pass-password-without-asking-any-more-password/38626/1 "2023-12-14T07:41:41Z")
Hello Team, how to encrypt ssh\_pass password without asking any more password. I dont want to type password everytime i run the ad hoc command like ansible -i hosts.yaml -m shell -a “ulimit -a”. I dont want to put the password everytime i just want to hide or obscure or salt the below password hosts.yaml has below all:vars [all:vars] ansible\_ssh\_common\_args=‘-o StrictHostKeyChecking=no’ ansible\_connection=ssh ansible\_port=22 ansible\_user=sam ansible\_ssh\_pass=abc@123 Now i want to hide ansible\_ssh\_pass variable or encrypt/salt this value thats it . how do i do that. I m ok even if i store that in plaintext and reference here . im fine evenits base64 just should not be in plain in hosts.yaml. ---
**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\ **Post date:** [December 14, 2023, 10:55pm UTC](https://forum.ansible.com/t/how-to-encrypt-ssh-pass-password-without-asking-any-more-password/38626/2 "2023-12-14T22:55:48Z")
I apologize for this type of response, because they bug me a lot. It’s when someone says, “I want to do X. How do I do X?” And the responder say, “You should want Y!” I don’t see an option in Ansible to read the ssh\_pass from a file. However, native ssh itself can be made to run the script named in the SSH\_ASKPASS environment variable, using its output as the ssh password. Perhaps that can be made to do what you describe. I haven’t done that myself. I don’t know if the paramiko ssh implementation supports that either. But what you describe — “I don’t want to type a password every time…” — is better achieved by setting up and using ssh keys. I encourage you to look into that solution. Picky unrelated stuff: - Your “hosts.yaml” inventory isn’t a YAML file. Looks like the “ini” format to me. - People seem to enjoy sticking host variables into inventories. There are other ways to associated such data with hosts. My personal preference is to limit inventories to listing hosts and associating them through groups, putting anything else somewhere else. But maybe that’s just me. ---
**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\ **Post date:** [December 14, 2023, 11:32pm UTC](https://forum.ansible.com/t/how-to-encrypt-ssh-pass-password-without-asking-any-more-password/38626/3 "2023-12-14T23:32:08Z")
According to the conversation at [http://forum.ansible.com/t/ansible-inventory-as-json-and-inline-vaulted-data-does-not-work-works-with-yaml-inventory/2909](http://forum.ansible.com/t/ansible-inventory-as-json-and-inline-vaulted-data-does-not-work-works-with-yaml-inventory/2909) true .yaml inventories permit vaulted values, so that should work for your requirements. You’ll need to convert your inventory from .ini format to .yml, and vault your password with “ansible-vault encrypt\_string…”, ---
**Author:** ![Stu](https://avatars.discourse-cdn.com/v4/letter/s/3ec8ea/32.png) [@Stu](https://forum.ansible.com/u/Stu)\ **Post date:** [December 15, 2023, 8:44am UTC](https://forum.ansible.com/t/how-to-encrypt-ssh-pass-password-without-asking-any-more-password/38626/4 "2023-12-15T08:44:06Z")
Use an SSH key then no password is needed. Or create a separate vars file P\_vars or something and have p\_ansible\_ssh\_pass=yourpassword encrypt that file with ansible vault then reference that in your all:vars ansible\_ssh\_pass={{ p\_ansible\_ssh\_pass }} you can then see the file and non secure vars without having to un-encrypt the vault but can see that a password stored in vault is used and what it’s name is. you then have the problem the ansible vault password is needed every time you run your playbook / add hoc commands but you can include a reference to that in your .ansible.cfg and have it reference somewhere on your machine that isn’t included in your source control and protected to only be ready by your user. ---
**Author:** ![dbs34](https://avatars.discourse-cdn.com/v4/letter/d/8dc957/32.png) [@dbs34](https://forum.ansible.com/u/dbs34)\ **Post date:** [December 15, 2023, 2:14pm UTC](https://forum.ansible.com/t/how-to-encrypt-ssh-pass-password-without-asking-any-more-password/38626/5 "2023-12-15T14:14:29Z")
Here is how I do it. I think this is what you want. The way I did it is using a SSH keyring. In the ansible.cfg private\_key\_file = /etc/ansible/id\_rsa\_ansible Next share the public key out to all clients, then on the ansible server I created a shell script that invokes #!/bin/env bash ssh-agent /usr/bin/sshinit.opt in my opt file i have a simple if clause. if [-s “/etc/ansible/id\_rsa\_ansible”]; then /usr/bin/ssh-add /etc/ansible/id\_rsa\_ansible echo “SSH KEY added and initialized” cd /etc/ansible && $SHELL else echo id\_rsa\_ansible was not found, zero size. fi so on my ansible control node ( server ) I run sshinit it prompts me for the private key password I created now I can login or run any ansible command or playbook with no pasword prompts once your public key is in each clients .ssh/authorized\_keys file. If I want to schedule a cronjob that runs a playbook on a bunch of clients, you have to export the environment variable SSH\_AUTH\_SOCK in your cronjob playbook script. env |grep -i ssh SSH\_CONNECTION=10.50.10.22 51630 10.50.3.71 22 SSH\_AUTH\_SOCK=/tmp/ssh-FwQS5lko0os0/agent.9366 SSH\_AGENT\_PID=9367 SSH\_CLIENT=10.50.10.22 51630 22 SSH\_TTY=/dev/pts/0 ---
**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\ **Post date:** [December 15, 2023, 2:20pm UTC](https://forum.ansible.com/t/how-to-encrypt-ssh-pass-password-without-asking-any-more-password/38626/6 "2023-12-15T14:20:40Z")
SSH\_ASKPASS also requires DISPLAY (X11 working) so it is not really viable option for Ansible as it is often run from a configuration server/instance that rarely has X11 installed. But if you have such an environment you should be able to set it up that way.