# Using Pathword Authentication to run a Playbook **URL:** \ **Category:** Ansible Project\ **Created:** [July 21, 2017, 4:21pm UTC](https://forum.ansible.com/t/using-pathword-authentication-to-run-a-playbook/25047 "2017-07-21T16:21:35Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![JS11](https://avatars.discourse-cdn.com/v4/letter/j/f17d59/32.png) [@JS11](https://forum.ansible.com/u/JS11)\ **Post date:** [July 21, 2017, 4:21pm UTC](https://forum.ansible.com/t/using-pathword-authentication-to-run-a-playbook/25047/1 "2017-07-21T16:21:35Z")
Hello! I have a single playbook that with various plays in it. It goes out to different environments, either dev, uat, or prod (based on the --extra-vars input by the user deploying the playbook). > i.e. ansible-playbook -i hosts deploy.yml --extra-vars “env=uat” Is there anyway I can set the ansible-playbook to require a password if a user selects the prod environment? They should be allowed to deploy to dev and uat without any authentication or passwords. Thanks JS ---
**Author:** ![Kai\_Stian\_Olstad](https://avatars.discourse-cdn.com/v4/letter/k/e19adc/32.png) [@Kai\_Stian\_Olstad](https://forum.ansible.com/u/Kai_Stian_Olstad)\ **Post date:** [July 22, 2017, 3:17pm UTC](https://forum.ansible.com/t/using-pathword-authentication-to-run-a-playbook/25047/2 "2017-07-22T15:17:33Z")
Since you use Pathword in the subject I guess you are after an hurdel so users don't accidentally run against production? If so, you can do something like this: - pre\_tasks:    - pause:        prompt: "You are running against production. What is the magic word?"      register: result      when: env == 'prod'    - fail:        msg: "Aborting, wrong magic."        when: result.user\_input | default('') != 'answerable' and env == 'prod' If not you could use password against production and keys on the other environments. ---
**Author:** ![Dick\_Davies](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@Dick\_Davies](https://forum.ansible.com/u/Dick_Davies)\ **Post date:** [July 22, 2017, 3:55pm UTC](https://forum.ansible.com/t/using-pathword-authentication-to-run-a-playbook/25047/3 "2017-07-22T15:55:24Z")
What about not putting the users keys onto the production servers? ---
**Author:** ![JS11](https://avatars.discourse-cdn.com/v4/letter/j/f17d59/32.png) [@JS11](https://forum.ansible.com/u/JS11)\ **Post date:** [July 24, 2017, 8:49am UTC](https://forum.ansible.com/t/using-pathword-authentication-to-run-a-playbook/25047/4 "2017-07-24T08:49:42Z")
Hi Kai Fantastic, many thanks for your reply! I’ll give your play shot (I prefer having the keys setup as I have also made the playbooks available via Jenkins for automation!) and if that doesn’t work I’ll use the password authentication for Prod and Keys for the other environments! Regards JS ---
**Author:** ![JS11](https://avatars.discourse-cdn.com/v4/letter/j/f17d59/32.png) [@JS11](https://forum.ansible.com/u/JS11)\ **Post date:** [July 24, 2017, 8:51am UTC](https://forum.ansible.com/t/using-pathword-authentication-to-run-a-playbook/25047/5 "2017-07-24T08:51:12Z")
Hi Dick Fantastic, many thanks for your reply! I’ll give Kai’s play above a shot (I prefer having the keys setup as I have also made the playbooks available via Jenkins for automation!) and if that doesn’t work I’ll use the password authentication for Prod and Keys for the other environments! Regards JS ---
**Author:** ![Timothy\_Brush](https://avatars.discourse-cdn.com/v4/letter/t/f14d63/32.png) [@Timothy\_Brush](https://forum.ansible.com/u/Timothy_Brush)\ **Post date:** [July 24, 2017, 10:25pm UTC](https://forum.ansible.com/t/using-pathword-authentication-to-run-a-playbook/25047/6 "2017-07-24T22:25:05Z")
Just starting to use Ansible but wouldn't this be better solved using a separate ssh key for prod systems that requires a password that only authorized personnel have access to and loading that key into ssh agent before running plays? Depending on you naming scheme, you may even be able to specify production hosts via wildcard in ~/.ssh/config file. This not only limits the ability to push to production but adds additional security. Note: Ansible's user module can be used to push out new ssh authorized keys. Apologies if this solution is off the mark but my background is in information security. ---
**Author:** ![JS11](https://avatars.discourse-cdn.com/v4/letter/j/f17d59/32.png) [@JS11](https://forum.ansible.com/u/JS11)\ **Post date:** [July 25, 2017, 11:29am UTC](https://forum.ansible.com/t/using-pathword-authentication-to-run-a-playbook/25047/7 "2017-07-25T11:29:46Z")
Hi Kai Thanks for that - it worked like a charm on the CLI! > - pre\_tasks: > > - pause: > prompt: “You are running against production. What is the magic word?” > register: result > when: env == ‘prod’ > > - fail: > msg: “Aborting, wrong magic.” > when: result.user\_input | default(‘’) != ‘answerable’ and env == ‘prod’ I’ve integrated the playbook with Jenkins - so it doesn’t work on there. I get the following error: [WARNING]: Not waiting from prompt as stdin is not interactive But I suppose that’s not a problem as we can run DEV/UAT via Jenkins (GUI) and the PROD environment via CLI. ---
**Author:** ![alikins](https://avatars.discourse-cdn.com/v4/letter/a/d07c76/32.png) [@alikins](https://forum.ansible.com/u/alikins)\ **Post date:** [July 26, 2017, 9:57pm UTC](https://forum.ansible.com/t/using-pathword-authentication-to-run-a-playbook/25047/8 "2017-07-26T21:57:48Z")
ansible-playbook isnt really the right tool for writing interactive tooling. There is some very limited support for it but it is not a good approach. Some of the previous mentioned suggestions (password protected prod only ssh keys and ssh-agent…) will be more useful in the long run. Or using a wrapper script to handle the interactivity if required. But avoid trying to use ansible as an interactive tool.