I am trying to setup Ansible to manage Linux boxes from different customers and here are what we have to work with.

  1. No Pub key authentication - I wanted it as much as you do but it won't happen any time soon.
  2. We login as root and each customer has a different root password for all linux boxes. We are pushing for disable direct root login and do everything via sudo but again, it will take some time.

I managed to create a ansible vault file for each customer with ansible_ssh_user and ansible_ssh_pass in it and following play-book works fine.

- hosts:
    - SERV01
    - SERV02
    - roles/common/vault/main.yml

    - name: enable and start ntpd
      service: name=ntpd enabled=yes state=running

Now I would like to know how can I use vault files from command line, but none of the following worked.

ansible customer1 -m shell -a "var_files:roles/common/vault/main.yml uptime" --ask-vault-pass

ansible customer1 -m shell -a "uptime" -e "vars_files:roles/common/vault/main.yml"  --ask-vault-pass

What am I doing wrong ?


  • ansible and ansible-playbook are different tools and do not have the same options. I don't see any -e in ansible. – Antonis Christofides Apr 29 '15 at 7:22
  • I don't agree that ansible and ansible-playbook are different and are you running latest Ansible ? I am using and here is the option -e EXTRA_VARS, --extra-vars=EXTRA_VARS set additional variables as key=value or YAML/JSON – Ask and Learn Apr 30 '15 at 0:40
  • Sorry, you are right, I was running an older version. – Antonis Christofides Apr 30 '15 at 8:39

Finally I found out how to do this:

ansible customer1 -e @group_vars/vault/customer1.yml --ask-vault-pass -m shell -a uptime

Now I can put ansible_ssh_user, ansible_ssh_pass and ansible_sudo_pass in a vault file and all I need to remember is the vault password.

I hope that makes Ansible more enjoyable for you as well.



I'm not certain whether Ansible can do that. If it can't, one way to do it is

ansible customer1 -e "`ansible-vault view roles/common/vault/main.yml | grep ansible_ssh_pass`" -m shell -a uptime
  • You command works when I use ansible_ssh_pass=whatever in the vault file but that will break palybook as mail.yml must be stored as a dictionary/hash format for example ansible_ssh_pass: whatever. Your command worked after I did some modification but I think I will open an issue with Ansible team to see if they can add this. Thanks – Ask and Learn May 1 '15 at 0:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.