I'm setting ansible to manage a whole farm of servers. My approach is the following:

Allow a user to connect to all servers protecting his connections with a heavy RSA key, passphrase protected, and user password.

In order to automate as much as possible the process I would like to pass the RSA passphrase and the user password in a vault file or an encrypted string.

When I'm testing (passing the passwords manually) with just a ping to a test server if I set up in client both authentication methods (publickey + user password), I'm prompted for RSA passphrase but no password, and obviously the execution of the playbook fails.

If i just set up user password as authentication method the playbook is executed normally.

If i just set up RSA key with it's passphrase authentication the job does not end, this the output I've had in my screen for at least 30 minutes (time for research, coffee, ..)

PLAY [all] ******************************************************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************************************************
Enter passphrase for key '/home/users/<user_name>/.ssh/id_rsa': 
ok: [<test_server_ip_address>]

TASK [include vars] *********************************************************************************************************************************************************
ok: [<test_server_ip_address>]

TASK [test connection] ******************************************************************************************************************************************************

And anything else.

The playbook that I'm trying to execute is this one

- hosts: all
    - name: test connection

And the command to execute the playbok the next one:

ansible-playbook -i ansible_hosts/test_hosts.yml playbooks/ping.yml

The content of test_host.yml :


My question is:

Is it possible to set up double factor authentication for ansible? An if yes, can anyone redirect me in the right direction please?


I doubt you can use ssh key's passphrase from Ansible vault, but the general 2-factor workflow is as follows:

On the server side, enable 2-factor Auth with

AuthenticationMethods "publickey,password"

in sshd_config.

On the client side (Ansible):

  1. Setup ssh-agent, add password protected key to agent when connection is required
  2. Define ansible_password in Ansible vault for every host
  3. Run playbook
  • Thanks for your anwser Konstantin. Server side was clear. Otherwise I'm having troubles to define ansible_ssh_pass in a vault file. I know that the command is ansible-vault encrypt_string '<password>' --name 'ansible_ssh_pass' --ask-vault-pass but when copying it into a playbook file I have always an error saying that the parameter is not recognized. The only way to make it work is to define ansible_ssh_pass in inventory file. What I'm missing ??
    – Abel
    Dec 20 '17 at 15:15
  • Actually I've just seen another post from yourself (stackoverflow.com/questions/23767765/…) where you explain it very well.
    – Abel
    Dec 20 '17 at 15:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.