# looking for advice on storing connection passwords

**URL:** <https://forum.ansible.com/t/looking-for-advice-on-storing-connection-passwords/27955>\
**Category:** Ansible Project\
**Tags:** windows\
**Created:** [July 5, 2018, 12:18pm UTC](https://forum.ansible.com/t/looking-for-advice-on-storing-connection-passwords/27955 "2018-07-05T12:18:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![erichymowitz](https://avatars.discourse-cdn.com/v4/letter/e/9d8465/32.png) [@erichymowitz](https://forum.ansible.com/u/erichymowitz)\
**Post date:** [July 5, 2018, 12:18pm UTC](https://forum.ansible.com/t/looking-for-advice-on-storing-connection-passwords/27955/1 "2018-07-05T12:18:16Z")

</div>

So we have some windows machines, and right now, we have this in our /etc/ansible/hosts file:

[windows:vars]  
ansible\_connection=winrm  
ansible\_user=AdminAccount  
ansible\_password=AdminPassword  
ansible\_winrm\_transport=ntlm  
ansible\_winrm\_server\_cert\_validation=ignore

Obviously that’s not the best idea.

My goal would be this:

1. Have the above lines in a group-vars file /etc/ansible/group\_vars/windows/connection.yaml
2. ansible-vault-encrypt that file
3. Somehow have ansible recognize/know/understand that **IF AND ONLY IF** I need to access this file because I called a host in that group **THEN** it should act as though I had passed the --ask-vault-pass option.

Is that number 3 possible, somehow attach an --ask-vault-pass flag to a specific host group?

Another option which my co-worker discovered is that you can leave out the password from the vars file, and use the -k flag to ask for it. Same question – can I somehow attach a -k flag to specific hosts that always need it, without imposing on hosts/playbooks that don’t?

Thanks.

–EbH

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [July 5, 2018, 4:25pm UTC](https://forum.ansible.com/t/looking-for-advice-on-storing-connection-passwords/27955/2 "2018-07-05T16:25:07Z")

</div>

Recent versions of Ansible should only load a group\_vars file if  
needed, but a problem is that a hostvars['windowsmachine'] reference  
will also load that file (as it needs the vars for that host), even if  
you are not directly connecting to it.

As for the -k flag, there is a configuration entry for it, but there  
is no 'per host' as it is a global and has to prompt before starting  
the plays and the host loop.

Another option is vaulting the inventory file itself.

Also, look into AWX/Tower, it provides a full RBAC system and credential safety.

---

<div class="post-metadata">

**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\
**Post date:** [July 6, 2018, 9:23am UTC](https://forum.ansible.com/t/looking-for-advice-on-storing-connection-passwords/27955/3 "2018-07-06T09:23:39Z")

</div>

I suggest you vault your connection.yaml file and set a relative location for the vault password file in your ansible.cfg like this

vault\_password\_file = ~/.vault

This at least lets you keep encrypted password on disk - anyone with the vault password file has access to the hosts they need.

You may well want to limit the ‘blast radius’ by using different vault keys for different environments.

Another option if you have kerberos / active directory in your environment is to acquire a kerberos ticket when the user logs in (either because the host is set up to authenticate against active directory, or via a login script that runs kinit) and then configure ansible to use the ‘ambient’ ticket by setting `ansible_winrm_kinit_mode` to `manual`, as mentioned here: [https://docs.ansible.com/ansible/latest/user\_guide/windows\_winrm.html#kerberos](https://docs.ansible.com/ansible/latest/user_guide/windows_winrm.html#kerberos)

That way. you wouldn’t need to store a password for the windows hosts.

Hope this helps,

Jon