<p>It is unclear why it failed, but setting <code>vault_password_file = ~/.vault_pass.txt</code> in <code>/etc/ansible/ansible.cfg</code> was sufficient.</p>

CC BY-SA 3.0
2017-04-14T07:42:55.430Z
2017-04-14T07:42:55.430Z
030
<p>I found an issue with Ansible/Python causing a failure to decrypt.</p>

<p>Specifically, Ansible 2.7.10 and 2.7.13 under Python 3.6.8 on Ubuntu 18.04 would not decrypt (using <code>ansible-vault edit -vvvvv</code>) a vault file that was identical to file that decrypted OK on macOS 10.13 using Python 3.7.2 with same Ansible versions.</p>

<p>Upgrading to Python 3.7.3 on Ubuntu (using <code>apt-get install python3.7</code> on 18.04) fixed this.</p>

<p>Your issue may be different, but if on Python 3.6 or lower, I would try upgrading to 3.7.</p>

CC BY-SA 4.0
2021-05-18T18:29:29.620Z
I can confirm a similar behavior: I started an `ansible` project using python3.* in a virtual environment on OSX; I then cloned it onto an Ubuntu 20.04LTS machine and started using the `vault-keyring-client.py` script to pull my vault password from my system keyring, so I didn't have to store it at rest (https://github.com/ansible-collections/community.general/blob/main/scripts/vault/vault-keyring-client.py) I configured it properly, and encrypted and then viewed a file with `ansible-vault`, but simply viewing or decrypting strings/files encrypted on OSX threw an HMAC verification failure.
Life5ign
CC BY-SA 4.0
2021-05-18T18:31:17.743Z
I guess I need to re-encrypt all the files and strings that were originally encrypted on the OSX machine.  I am using a `pyenv` python 3.* in a virtual environment on both machines, so I'm a little confused
Life5ign
CC BY-SA 4.0
2021-05-19T05:35:17.613Z
@Life5ign Interesting - which versions of Python are you using on macOS and Ubuntu?  If not the same, can you try 3.7 on both?  This would help diagnose if it's a Python version issue or macOS vs Ubuntu difference.
RichVel
CC BY-SA 4.0
2019-09-19T08:27:49.273Z
2019-09-19T08:27:49.273Z
RichVel
<p>According to the <a href="http://docs.ansible.com/ansible/playbooks_vault.html" rel="nofollow noreferrer">docs</a>, </p>

<blockquote>
  <p>You can also set ANSIBLE_VAULT_PASSWORD_FILEenvironment variable, e.g. ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txtand Ansible will automatically search for the password in that file.</p>
</blockquote>

<p>Ensures that you are using the exact same case. </p>

CC BY-SA 3.0
2017-04-02T20:58:21.057Z
You are'missing the question, it is about configuration file property specially, it is stated literally in the question, read it again carefully
Tensibai
CC BY-SA 3.0
2017-04-02T15:39:54.527Z
2017-04-02T15:39:54.527Z
Findarato
<p>Follow-up to this <a href="https://devops.stackexchange.com/q/703/210">Q&amp;A</a>.</p>

<p>According to this and this documentation it should be possible to define a default vault password file by specifying <code>vault_password_file = ~/.vault_pass.txt</code> in one of the following files:</p>

<blockquote>
<pre><code>* ANSIBLE_CONFIG (an environment variable)
* ansible.cfg (in the current directory)
* .ansible.cfg (in the home directory)
* /etc/ansible/ansible.cfg
</code></pre>
</blockquote>

<p>Although the password file exists and the log indicates that the ansible.cfg is used that contains the definition, the decryption fails:</p>

<pre><code>user@host$
Using /etc/ansible/ansible.cfg as config file
ERROR! Decryption failed on /path/to/ansible/group_vars/production/vault
</code></pre>

<p><strong>Discussion</strong></p>

<ul>
<li><blockquote>
  <p>Is the pass correct for this vault?</p>
</blockquote></li>
</ul>

<p>Yes. When ansible is run using <code>--vault-password-file=~/.vault_pass.txt</code> the decryption succeeds.</p>

<ul>
<li><blockquote>
  <p>Just so that we're clear - the name of the environment variable is <code>ANSIBLE_VAULT_PASSWORD_FILE</code>, correct?</p>
</blockquote></li>
</ul>

<p>No. When this variable is used it works, but the aim is to set it in the ansible.cfg by setting <code>/etc/ansible/ansible.cfg</code>.</p>

<ul>
<li><blockquote>
  <p>What Ansible version is used?</p>
</blockquote>

<pre><code>user@host:/dir$ ansible --version
ansible 2.2.2.0
    config file = /etc/ansible/ansible.cfg
    configured module search path = Default w/o overrides
</code></pre></li>
<li><blockquote>
  <p>Does using a full path in the config works?</p>
</blockquote></li>
</ul>

<p>The decryption failes as well when the full path instead of <code>~</code>, i.e. <code>/home/user/.vault_pass.txt</code> was specified.</p>

CC BY-SA 3.0
2017-03-30T08:18:01.783Z
Just so that we're clear - the name of the environment variable is `ANSIBLE_VAULT_PASSWORD_FILE`, correct?
13dimitar
CC BY-SA 3.0
2017-03-30T10:05:18.477Z
And what's the output of `echo $ANSIBLE_VAULT_PASSWORD_FILE`?
13dimitar
CC BY-SA 3.0
2017-03-30T10:08:27.957Z
it is empty because I try to use `vault_password_file = ~/.vault_pass.txt`
030
CC BY-SA 3.0
2017-03-30T10:16:57.803Z
variable names are case sensitive
13dimitar
CC BY-SA 3.0
2017-03-30T11:40:35.400Z
This is set in the ansible.cfg. I am not using an environment variable
030
CC BY-SA 3.0
2017-03-30T17:15:57.567Z
Definitely a strange scenario. Do you have any other non-default variables in /etc/ansible/ansible.cfg that *are* being set correctly? And to confirm, you ran this in full verbosity (-vvv) and there is no additional output between "Using /etc/ansible/ansible.cfg as config file" and "ERROR", right? I couldn't find this exact issue in Github, but even without a smoking gun, consider trying this in Ansible 2.3
Woodland
CC BY-SA 3.0
2017-04-03T06:39:06.547Z
Are you using the ```vault_password_file = /path/to/file``` under ```[defaults]``` in your config file?
sanzante
<ansible-vault>
Why could the encrypted Ansible files not be decrypted although the vault password file has been set?
030
# Why could the encrypted Ansible files not be decrypted although the vault password file has been set?

(Asked by: username_0 on 2017-03-30)

Follow-up to this Q&A.
According to this and this documentation it should be possible to define a default vault password file by specifying vault_password_file = ~/.vault_pass.txt in one of the following files:

* ANSIBLE_CONFIG (an environment variable)
* ansible.cfg (in the current directory)
* .ansible.cfg (in the home directory)
* /etc/ansible/ansible.cfg


Although the password file exists and the log indicates that the ansible.cfg is used that contains the definition, the decryption fails:
user@host$
Using /etc/ansible/ansible.cfg as config file
ERROR! Decryption failed on /path/to/ansible/group_vars/production/vault

Discussion


Is the pass correct for this vault?


Yes. When ansible is run using --vault-password-file=~/.vault_pass.txt the decryption succeeds.


Just so that we're clear - the name of the environment variable is ANSIBLE_VAULT_PASSWORD_FILE, correct?


No. When this variable is used it works, but the aim is to set it in the ansible.cfg by setting /etc/ansible/ansible.cfg.


What Ansible version is used?

user@host:/dir$ ansible --version
ansible 2.2.2.0
    config file = /etc/ansible/ansible.cfg
    configured module search path = Default w/o overrides


Does using a full path in the config works?


The decryption failes as well when the full path instead of ~, i.e. /home/user/.vault_pass.txt was specified.

**Tags:** ansible-vault

> **Comments:**
> **username_1**: Just so that we're clear - the name of the environment variable is `ANSIBLE_VAULT_PASSWORD_FILE`, correct?  
> **username_1**: And what's the output of `echo $ANSIBLE_VAULT_PASSWORD_FILE`?  
> **username_0**: it is empty because I try to use `vault_password_file = ~/.vault_pass.txt`  
> **username_1**: variable names are case sensitive  
> **username_0**: This is set in the ansible.cfg. I am not using an environment variable  
> **username_2**: Definitely a strange scenario. Do you have any other non-default variables in /etc/ansible/ansible.cfg that *are* being set correctly? And to confirm, you ran this in full verbosity (-vvv) and there is no additional output between "Using /etc/ansible/ansible.cfg as config file" and "ERROR", right? I couldn't find this exact issue in Github, but even without a smoking gun, consider trying this in Ansible 2.3  
> **username_3**: Are you using the ```vault_password_file = /path/to/file``` under ```[defaults]``` in your config file?  

---

## 3 answers

### Answer by username_0 on 2017-04-14. Score: 1 | Accepted answer

It is unclear why it failed, but setting `vault_password_file = ~/.vault_pass.txt` in `/etc/ansible/ansible.cfg` was sufficient.


---

### Answer by username_4 on 2019-09-19. Score: 2

I found an issue with Ansible/Python causing a failure to decrypt.

Specifically, Ansible 2.7.10 and 2.7.13 under Python 3.6.8 on Ubuntu 18.04 would not decrypt (using `ansible-vault edit -vvvvv`) a vault file that was identical to file that decrypted OK on macOS 10.13 using Python 3.7.2 with same Ansible versions.

Upgrading to Python 3.7.3 on Ubuntu (using `apt-get install python3.7` on 18.04) fixed this.

Your issue may be different, but if on Python 3.6 or lower, I would try upgrading to 3.7.

> **Comments:**
> **username_5**: I can confirm a similar behavior: I started an `ansible` project using python3.* in a virtual environment on OSX; I then cloned it onto an Ubuntu 20.04LTS machine and started using the `vault-keyring-client.py` script to pull my vault password from my system keyring, so I didn't have to store it at rest (https://github.com/ansible-collections/community.general/blob/main/scripts/vault/vault-keyring-client.py) I configured it properly, and encrypted and then viewed a file with `ansible-vault`, but simply viewing or decrypting strings/files encrypted on OSX threw an HMAC verification failure.  
> **username_5**: I guess I need to re-encrypt all the files and strings that were originally encrypted on the OSX machine.  I am using a `pyenv` python 3.* in a virtual environment on both machines, so I'm a little confused  
> **username_4**: @username_5 Interesting - which versions of Python are you using on macOS and Ubuntu?  If not the same, can you try 3.7 on both?  This would help diagnose if it's a Python version issue or macOS vs Ubuntu difference.  

---

### Answer by username_6 on 2017-04-02. Score: -1

According to the [docs](http://docs.ansible.com/ansible/playbooks_vault.html),

> You can also set ANSIBLE\_VAULT\_PASSWORD\_FILEenvironment variable, e.g. ANSIBLE\_VAULT\_PASSWORD\_FILE=~/.vault\_pass.txtand Ansible will automatically search for the password in that file.

Ensures that you are using the exact same case.

> **Comments:**
> **username_7**: You are'missing the question, it is about configuration file property specially, it is stated literally in the question, read it again carefully  

---

