# Password declaration in Clear text when using Kerberos ?

**URL:** <https://forum.ansible.com/t/password-declaration-in-clear-text-when-using-kerberos/30910>\
**Category:** Ansible Developer\
**Tags:** windows\
**Created:** [July 30, 2019, 9:28pm UTC](https://forum.ansible.com/t/password-declaration-in-clear-text-when-using-kerberos/30910 "2019-07-30T21:28:58Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Neeraj\_Shah](https://avatars.discourse-cdn.com/v4/letter/n/71e660/32.png) [@Neeraj\_Shah](https://forum.ansible.com/u/Neeraj_Shah)\
**Post date:** [July 30, 2019, 9:28pm UTC](https://forum.ansible.com/t/password-declaration-in-clear-text-when-using-kerberos/30910/1 "2019-07-30T21:28:58Z")

</div>

> ![](https://us1.discourse-cdn.com/ansible/original/2X/5/562320711b77ec4b96d0ae96267d5854106930be.png)  
>   
>   
>   
>   
>   
> |
> 
> - |

Hi All,  
As per official docs, using ansible to manage windows hosts requires us to specify the password in plain text for **ansible\_winrm\_transport** variable in the hosts file or the group\_vars file. My question or confusion is doesn’t security take a beating here ? In most cases we end up putting domain admin or local admin credentials here so how is this protected if the ansible linux host gets compromised ? How is this supposed to be secured ?

The following example shows host vars configured for Kerberos authentication:

```auto
ansible_user: [username@MY.DOMAIN.COM](mailto:username@MY.DOMAIN.COM)
ansible_password: Password
ansible_connection: winrm
ansible_winrm_transport: kerberos

```

---

<div class="post-metadata">

**Author:** ![Mark\_Janssen](https://avatars.discourse-cdn.com/v4/letter/m/e9c0ed/32.png) [@Mark\_Janssen](https://forum.ansible.com/u/Mark_Janssen)\
**Post date:** [July 31, 2019, 12:58pm UTC](https://forum.ansible.com/t/password-declaration-in-clear-text-when-using-kerberos/30910/2 "2019-07-31T12:58:26Z")

</div>

Either prompt for it from the commandline, or use a password-lookup like passwordstore or vault or somehing like that.

> **(attachments)**
>
> ![Auto Generated Inline Image 1.png](https://us1.discourse-cdn.com/ansible/original/2X/5/562320711b77ec4b96d0ae96267d5854106930be.png)

---

<div class="post-metadata">

**Author:** ![Tchia04](https://avatars.discourse-cdn.com/v4/letter/t/fbc32d/32.png) [@Tchia04](https://forum.ansible.com/u/Tchia04)\
**Post date:** [July 31, 2019, 4:57pm UTC](https://forum.ansible.com/t/password-declaration-in-clear-text-when-using-kerberos/30910/3 "2019-07-31T16:57:21Z")

</div>

You can use ansible vault to encrypt the username and / password or any other sensitive information and place the encrypted value in the playbook/group\_vars file so you can check into version control

Then during runtime if you have the correct vault key it will decrypt it on the fly

If you really want to be secure but to annoy your workers , you can encrypt the entire playbook/group\_vars file

Tony Chia

---

<div class="post-metadata">

**Author:** ![Neeraj\_Shah](https://avatars.discourse-cdn.com/v4/letter/n/71e660/32.png) [@Neeraj\_Shah](https://forum.ansible.com/u/Neeraj_Shah)\
**Post date:** [August 8, 2019, 1:40pm UTC](https://forum.ansible.com/t/password-declaration-in-clear-text-when-using-kerberos/30910/4 "2019-08-08T13:40:48Z")

</div>

Thank you Tony and Mark.