10

Follow-up to this Q&A.

According to this and this documentation it should be possible to define a default vault password file by specifying vault_password_file = ~/.vault_pass.txt in one of the following files:

* ANSIBLE_CONFIG (an environment variable)
* ansible.cfg (in the current directory)
* .ansible.cfg (in the home directory)
* /etc/ansible/ansible.cfg

Although the password file exists and the log indicates that the ansible.cfg is used that contains the definition, the decryption fails:

user@host$
Using /etc/ansible/ansible.cfg as config file
ERROR! Decryption failed on /path/to/ansible/group_vars/production/vault

Discussion

  • Is the pass correct for this vault?

Yes. When ansible is run using --vault-password-file=~/.vault_pass.txt the decryption succeeds.

  • Just so that we're clear - the name of the environment variable is ANSIBLE_VAULT_PASSWORD_FILE, correct?

No. When this variable is used it works, but the aim is to set it in the ansible.cfg by setting /etc/ansible/ansible.cfg.

  • What Ansible version is used?

    user@host:/dir$ ansible --version
    ansible 2.2.2.0
        config file = /etc/ansible/ansible.cfg
        configured module search path = Default w/o overrides
    
  • Does using a full path in the config works?

The decryption failes as well when the full path instead of ~, i.e. /home/user/.vault_pass.txt was specified.

7
  • 1
    Just so that we're clear - the name of the environment variable is ANSIBLE_VAULT_PASSWORD_FILE, correct?
    – 13dimitar
    Mar 30 '17 at 8:18
  • And what's the output of echo $ANSIBLE_VAULT_PASSWORD_FILE?
    – 13dimitar
    Mar 30 '17 at 10:05
  • it is empty because I try to use vault_password_file = ~/.vault_pass.txt
    – 030
    Mar 30 '17 at 10:08
  • variable names are case sensitive
    – 13dimitar
    Mar 30 '17 at 10:16
  • This is set in the ansible.cfg. I am not using an environment variable
    – 030
    Mar 30 '17 at 11:40
2

I found an issue with Ansible/Python causing a failure to decrypt.

Specifically, Ansible 2.7.10 and 2.7.13 under Python 3.6.8 on Ubuntu 18.04 would not decrypt (using ansible-vault edit -vvvvv) a vault file that was identical to file that decrypted OK on macOS 10.13 using Python 3.7.2 with same Ansible versions.

Upgrading to Python 3.7.3 on Ubuntu (using apt-get install python3.7 on 18.04) fixed this.

Your issue may be different, but if on Python 3.6 or lower, I would try upgrading to 3.7.

3
  • I can confirm a similar behavior: I started an ansible project using python3.* in a virtual environment on OSX; I then cloned it onto an Ubuntu 20.04LTS machine and started using the vault-keyring-client.py script to pull my vault password from my system keyring, so I didn't have to store it at rest (github.com/ansible-collections/community.general/blob/main/…) I configured it properly, and encrypted and then viewed a file with ansible-vault, but simply viewing or decrypting strings/files encrypted on OSX threw an HMAC verification failure.
    – Life5ign
    May 18 at 18:29
  • I guess I need to re-encrypt all the files and strings that were originally encrypted on the OSX machine. I am using a pyenv python 3.* in a virtual environment on both machines, so I'm a little confused
    – Life5ign
    May 18 at 18:31
  • @Life5ign Interesting - which versions of Python are you using on macOS and Ubuntu? If not the same, can you try 3.7 on both? This would help diagnose if it's a Python version issue or macOS vs Ubuntu difference.
    – RichVel
    May 19 at 5:35
1

It is unclear why it failed, but setting vault_password_file = ~/.vault_pass.txt in /etc/ansible/ansible.cfg was sufficient.

-1

According to the docs,

You can also set ANSIBLE_VAULT_PASSWORD_FILEenvironment variable, e.g. ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txtand Ansible will automatically search for the password in that file.

Ensures that you are using the exact same case.

1
  • 1
    You are'missing the question, it is about configuration file property specially, it is stated literally in the question, read it again carefully
    – Tensibai
    Apr 2 '17 at 20:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.