# Read vault password using gpg-agent **URL:** \ **Category:** Ansible Project\ **Created:** [August 1, 2014, 5:48am UTC](https://forum.ansible.com/t/read-vault-password-using-gpg-agent/15829 "2014-08-01T05:48:21Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Dale](https://avatars.discourse-cdn.com/v4/letter/d/ecd19e/32.png) [@Dale](https://forum.ansible.com/u/Dale)\ **Post date:** [August 1, 2014, 5:48am UTC](https://forum.ansible.com/t/read-vault-password-using-gpg-agent/15829/1 "2014-08-01T05:48:21Z")
Hi Ansible users, I’ve been trying to use vault lately but I got tired of having to enter my passphrase every time I ran ansible-playbook. I didn’t want to put my passphrase into a file on disk, either. Luckily, the next major release of Ansible will include the ability for vault\_password\_file to point at a script that will be run to get your passphrase.[1] Using this new functionality I wrote a tiny vault\_password\_file script that reads your passphrase via gpg-agent. gpg-agent will then cache that passphrase for you (by default) so you won’t have to enter it every time you run an Ansible command. I thought others might find this useful. If so, the script can be found at: [https://github.com/dsedivec/ansible-plugins/blob/master/vault\_from\_gpg\_agent.py](https://github.com/dsedivec/ansible-plugins/blob/master/vault_from_gpg_agent.py) To reiterate, as of right now I believe this will only work with Ansible from the Git devel branch. If an Ansible maintainer thinks this has a place in some more official repository somewhere I’m happy to make a pull request, just give me a hint where it should go. Regards, Dale ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [August 1, 2014, 11:37am UTC](https://forum.ansible.com/t/read-vault-password-using-gpg-agent/15829/2 "2014-08-01T11:37:21Z")
There’s a pull request for direct GPG support in vault as well, that we need to evaluate [https://github.com/ansible/ansible/pull/7174](https://github.com/ansible/ansible/pull/7174) “Luckily, the next major release of Ansible will include the ability for vault\_password\_file to point at a script that will be run to get your passphrase.” FYI - I don’t remember merging this one. If we didn’t merge that yet, I’m not opposed. Perhaps James did and I didn’t notice, but there should be instructions added in docs to reference how to use it before this is complete. It may be a case of comparing the two submissions, can you please comment on the above pull request? Thanks! ---
**Author:** ![sivel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sivel/32/1198_2.png) [@sivel](https://forum.ansible.com/u/sivel)\ **Post date:** [August 1, 2014, 1:18pm UTC](https://forum.ansible.com/t/read-vault-password-using-gpg-agent/15829/3 "2014-08-01T13:18:34Z")
The PR for using a script for the password file did include some documentation which is available at: [http://docs.ansible.com/playbooks\_vault.html#running-a-playbook-with-vault](http://docs.ansible.com/playbooks_vault.html#running-a-playbook-with-vault) It is not extensive but does give some information as to what ansible expects. James merged the PR a few weeks ago. ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [August 1, 2014, 2:25pm UTC](https://forum.ansible.com/t/read-vault-password-using-gpg-agent/15829/4 "2014-08-01T14:25:27Z")
Thanks. Docs need to indicate when a parameter is version specific, I’ll take care of it. ---
**Author:** ![Dale](https://avatars.discourse-cdn.com/v4/letter/d/ecd19e/32.png) [@Dale](https://forum.ansible.com/u/Dale)\ **Post date:** [August 2, 2014, 5:12pm UTC](https://forum.ansible.com/t/read-vault-password-using-gpg-agent/15829/5 "2014-08-02T17:12:57Z")
> There's a pull request for direct GPG support in vault as well, that we > need to evaluate > > [https://github.com/ansible/ansible/pull/7174](https://github.com/ansible/ansible/pull/7174) > > "Luckily, the next major release of Ansible will include the ability for > vault\_password\_file to point at a script that will be run to get your > passphrase." > > FYI - I don't remember merging this one. If we didn't merge that yet, I'm > not opposed. Perhaps James did and I didn't notice, but there should be > instructions added in docs to reference how to use it before this is > complete. > > It may be a case of comparing the two submissions, can you please comment > on the above pull request? > > Thanks! I'm sorry, I don't understand. What would you like me to comment on the above pull request for GPG vault file support? I don't have much to say about it, as I think this PR to use GPG for encrypting vault files is orthogonal to my script to use gpg-agent to store your vault passphrase. What I mean is that the PR you cited introduces a new vault encryption method, whereas my script will work with any vault encryption method that respects vault\_password\_file, including the default AES method and (apparently) this prospective GPG method. Of course, if you're actually invoking GPG, as in the above PR, then my script is probably not necessary as I expect GPG to use gpg-agent directly. (Though I can't tell if that's working quite right yet in the cited PR.) Dale ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [August 2, 2014, 5:54pm UTC](https://forum.ansible.com/t/read-vault-password-using-gpg-agent/15829/6 "2014-08-02T17:54:16Z")
We have in fact merged in the support for the --vault-password-file to take a script (marked chmod +x) that can return the vault password. I just hadn’t noticed that we merged it, which is all good 🙂 And yes, you’re exactly right - the two PRs are different things all together. The perils of a busy mailing list and too much going on. We should still see about the gpg encryption method itself as well. ---
**Author:** ![Bas\_Meijer](https://avatars.discourse-cdn.com/v4/letter/b/3e96dc/32.png) [@Bas\_Meijer](https://forum.ansible.com/u/Bas_Meijer)\ **Post date:** [August 6, 2014, 5:06am UTC](https://forum.ansible.com/t/read-vault-password-using-gpg-agent/15829/7 "2014-08-06T05:06:18Z")
Would it be possible to extend this to use the ssh-agent? ---
**Author:** ![Dale](https://avatars.discourse-cdn.com/v4/letter/d/ecd19e/32.png) [@Dale](https://forum.ansible.com/u/Dale)\ **Post date:** [August 6, 2014, 6:24am UTC](https://forum.ansible.com/t/read-vault-password-using-gpg-agent/15829/8 "2014-08-06T06:24:01Z")
I looked into using ssh-agent first. It \*might\* be possible, but ssh-agent is really not designed for this purpose. Check out the protocol description for ssh-agent[1]: It really expects to be given asymmetric key data, not passphrases, and it expects to perform challenges/signatures, not to hand back the data that you load into it. You might be able to trick it into storing your passphrase as part of public key parameters and then retrieve it with a "request identities" message, but I generally have a bad feeling about that working now and in the future. Contrast with gpg-agent which specifically includes the ability to store and retrieve passphrases. (FWIW I think there is some way to use gpg-agent as a replacement for ssh-agent.[2] I've never tried it.) Dale [1]: [http://openbsd.cs.toronto.edu/cgi-bin/cvsweb/src/usr.bin/ssh/PROTOCOL.agent?rev=1.7&content-type=text/x-cvsweb-markup](http://openbsd.cs.toronto.edu/cgi-bin/cvsweb/src/usr.bin/ssh/PROTOCOL.agent?rev=1.7&content-type=text/x-cvsweb-markup) [2]: [https://wiki.archlinux.org/index.php/SSH\_keys#GnuPG\_Agent](https://wiki.archlinux.org/index.php/SSH_keys#GnuPG_Agent)