# Isn't password declared in plain text under vars  when using kerberos ?

**URL:** <https://forum.ansible.com/t/isnt-password-declared-in-plain-text-under-vars-when-using-kerberos/30908>\
**Category:** Ansible Project\
**Tags:** windows\
**Created:** [July 30, 2019, 6:19pm UTC](https://forum.ansible.com/t/isnt-password-declared-in-plain-text-under-vars-when-using-kerberos/30908 "2019-07-30T18:19:15Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Neeraj\_Shah](https://avatars.discourse-cdn.com/v4/letter/n/71e660/32.png) [@Neeraj\_Shah](https://forum.ansible.com/u/Neeraj_Shah)\
**Post date:** [July 30, 2019, 6:19pm UTC](https://forum.ansible.com/t/isnt-password-declared-in-plain-text-under-vars-when-using-kerberos/30908/1 "2019-07-30T18:19:15Z")

</div>

Hi All,  
As per official docs, using ansible to manage windows hosts requires us to specify the password in plain text for **ansible\_winrm\_transport** variable in the hosts file or the group\_vars file. My question or confusion is doesn’t security take a beating here ? In most cases we end up putting domain admin or local admin credentials here so how is this protected if the ansible linux host gets compromised ? How is this supposed to be secured ?

The following example shows host vars configured for Kerberos authentication:

```auto
ansible_user: username@MY.DOMAIN.COM
ansible_password: Password
ansible_connection: winrm
ansible_winrm_transport: kerberos

```

---

<div class="post-metadata">

**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\
**Post date:** [July 30, 2019, 10:57pm UTC](https://forum.ansible.com/t/isnt-password-declared-in-plain-text-under-vars-when-using-kerberos/30908/2 "2019-07-30T22:57:43Z")

</div>

There are multiple ways you can get around this, you could;

- Store the password in a vault file so the user would need to know the vault key when running your playbook
- Use a lookup plugin to lookup the password during runtime
- Don’t use a password at all, kerberos can use the existing ticket checked out with kinit before running the playbook  
You shouldn’t have your password in plaintext at all, most of the time the docs only have it there just for documentation purposes.

Thanks

Jordan

---

<div class="post-metadata">

**Author:** ![Neeraj\_Shah](https://avatars.discourse-cdn.com/v4/letter/n/71e660/32.png) [@Neeraj\_Shah](https://forum.ansible.com/u/Neeraj_Shah)\
**Post date:** [July 31, 2019, 12:03am UTC](https://forum.ansible.com/t/isnt-password-declared-in-plain-text-under-vars-when-using-kerberos/30908/3 "2019-07-31T00:03:59Z")

</div>

Thank you Jordan.