# vault password broken since f6a55a35525a6ca0b56ad856f2ab11bbd226c1b4 **URL:** \ **Category:** Ansible Developer\ **Created:** [August 11, 2014, 8:45pm UTC](https://forum.ansible.com/t/vault-password-broken-since-f6a55a35525a6ca0b56ad856f2ab11bbd226c1b4/15913 "2014-08-11T20:45:32Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Rene\_Moser](https://avatars.discourse-cdn.com/v4/letter/r/7bcc69/32.png) [@Rene\_Moser](https://forum.ansible.com/u/Rene_Moser)\ **Post date:** [August 11, 2014, 8:45pm UTC](https://forum.ansible.com/t/vault-password-broken-since-f6a55a35525a6ca0b56ad856f2ab11bbd226c1b4/15913/1 "2014-08-11T20:45:32Z")
Hi After updating to 1.7.0, I was not able to use " ansible-playbook --vault-password-file" anymore, ansible returned always ERROR: A vault password must be specified to decrypt data I created a small test shell script and run git bisect, which identified [https://github.com/ansible/ansible/commit/f6a55a35525a6ca0b56ad856f2ab11bbd226c1b4](https://github.com/ansible/ansible/commit/f6a55a35525a6ca0b56ad856f2ab11bbd226c1b4) to be the first commit broke. Can anyone confirm, I am not completely freaked out and ansible-playbook --vault-password-file and --ask-vault-password is really broken? Thanks. René ---
**Author:** ![Rene\_Moser](https://avatars.discourse-cdn.com/v4/letter/r/7bcc69/32.png) [@Rene\_Moser](https://forum.ansible.com/u/Rene_Moser)\ **Post date:** [August 11, 2014, 8:53pm UTC](https://forum.ansible.com/t/vault-password-broken-since-f6a55a35525a6ca0b56ad856f2ab11bbd226c1b4/15913/2 "2014-08-11T20:53:43Z")
Please ignore, this is not the correct commit which broke the functionality. ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [August 11, 2014, 8:54pm UTC](https://forum.ansible.com/t/vault-password-broken-since-f6a55a35525a6ca0b56ad856f2ab11bbd226c1b4/15913/3 "2014-08-11T20:54:30Z")
This works for me, is your vault password file chmod +x? If so, 1.7 will think it’s a script that should return the password. ---
**Author:** ![Rene\_Moser](https://avatars.discourse-cdn.com/v4/letter/r/7bcc69/32.png) [@Rene\_Moser](https://forum.ansible.com/u/Rene_Moser)\ **Post date:** [August 11, 2014, 9:41pm UTC](https://forum.ansible.com/t/vault-password-broken-since-f6a55a35525a6ca0b56ad856f2ab11bbd226c1b4/15913/4 "2014-08-11T21:41:11Z")
Hi no, my vault password file just has 0600 and works with ansible 1.6.10. OS Ubuntu 14.04. But with 1.7.0, even --ask-vault-pass fails. However. ansible-vault decrpyt and ansible-vault encrypt works with the very same password. Really weird. ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [August 12, 2014, 11:23am UTC](https://forum.ansible.com/t/vault-password-broken-since-f6a55a35525a6ca0b56ad856f2ab11bbd226c1b4/15913/5 "2014-08-12T11:23:41Z")
Matt indicated today that he missed some common logic to allow vault password files to be scripts to ansible-vault CLI commands, which means parts of vault were using slightly different operations. I can’t say this is related, I don’t know, but this is on my list to investigate to see if we can replicate this today. If we find something, this would be included in a 1.7.1. I’ll let you know if I have questions or what happens. ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [August 12, 2014, 2:39pm UTC](https://forum.ansible.com/t/vault-password-broken-since-f6a55a35525a6ca0b56ad856f2ab11bbd226c1b4/15913/6 "2014-08-12T14:39:40Z")
I just tested this on 1.7 and devel branches and was able to use --vault-password-file fine with both encrypted playbooks and vars\_files items, so I’m having some trouble reproducing this one. If you can supply a minimal playbook/file combo (and probably the vault password file) maybe we can see if we can reproduce this, but right now, I can’t make any problems happen. ---
**Author:** ![Rene\_Moser](https://avatars.discourse-cdn.com/v4/letter/r/7bcc69/32.png) [@Rene\_Moser](https://forum.ansible.com/u/Rene_Moser)\ **Post date:** [August 13, 2014, 8:48pm UTC](https://forum.ansible.com/t/vault-password-broken-since-f6a55a35525a6ca0b56ad856f2ab11bbd226c1b4/15913/7 "2014-08-13T20:48:47Z")
Hi Having some updates about this issue. I created a small setup repo [https://github.com/resmo/ansible-vault-debug](https://github.com/resmo/ansible-vault-debug) where you can just run “make”. Tested it on 2 Ubuntu 14.04 workstations → failed Tested on Debian 7.x → pass Ansible was installed by using: pip install ansible At this point, it seems related to Ubuntu 14.04. It would help if anyone else could test this repo on his Ubuntu 14.04 workstation: git clone [https://github.com/resmo/ansible-vault-debug.git](https://github.com/resmo/ansible-vault-debug.git) cd ansible-vault-debug make Regards René ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [August 14, 2014, 12:44pm UTC](https://forum.ansible.com/t/vault-password-broken-since-f6a55a35525a6ca0b56ad856f2ab11bbd226c1b4/15913/8 "2014-08-14T12:44:49Z")
We do have vault tests that run on Ubuntu, we can look at this hopefully today to see if we can replicate. We did fix some vault-related items recently on devel, though this was mostly around making --vault-password-file allow scripts, which should not come into play here. Thanks! ---
**Author:** ![James\_Cammarata](https://avatars.discourse-cdn.com/v4/letter/j/7c8e57/32.png) [@James\_Cammarata](https://forum.ansible.com/u/James_Cammarata)\ **Post date:** [August 14, 2014, 3:30pm UTC](https://forum.ansible.com/t/vault-password-broken-since-f6a55a35525a6ca0b56ad856f2ab11bbd226c1b4/15913/9 "2014-08-14T15:30:27Z")
Hi René, I’ve tracked this issue down and pushed the following commit to address it: [https://github.com/ansible/ansible/commit/bea0845322715737c0b6326db22e3d1812a5ac35](https://github.com/ansible/ansible/commit/bea0845322715737c0b6326db22e3d1812a5ac35) Please let us know if you’re continuing to see any further problems regarding this. Thanks! ---
**Author:** ![Rene\_Moser](https://avatars.discourse-cdn.com/v4/letter/r/7bcc69/32.png) [@Rene\_Moser](https://forum.ansible.com/u/Rene_Moser)\ **Post date:** [August 15, 2014, 8:39am UTC](https://forum.ansible.com/t/vault-password-broken-since-f6a55a35525a6ca0b56ad856f2ab11bbd226c1b4/15913/10 "2014-08-15T08:39:00Z")
Hi James I can confirm bea0845322715737c0b6326db22e3d1812a5ac35 fixes the problem! Great job. But can you explain, what the problem actually was? Why didn’t this caused any problem on other systems? Regards René ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [August 15, 2014, 12:00pm UTC](https://forum.ansible.com/t/vault-password-broken-since-f6a55a35525a6ca0b56ad856f2ab11bbd226c1b4/15913/11 "2014-08-15T12:00:13Z")
That function took positional arguments though the variable name being used wasn’t passed. It appears to be a difference in Python versions. –Michael