Answers: <p>It is unclear why it failed, but setting <code>vault_password_file = ~/.vault_pass.txt</code> in <code>/etc/ansible/ansible.cfg</code> was sufficient.</p>
  
Answers: CC BY-SA 3.0
Answers: 2017-04-14T07:42:55.430Z
Answers: 2017-04-14T07:42:55.430Z
Answers: 030
Answers: <p>I found an issue with Ansible/Python causing a failure to decrypt.</p>
  
  <p>Specifically, Ansible 2.7.10 and 2.7.13 under Python 3.6.8 on Ubuntu 18.04 would not decrypt (using <code>ansible-vault edit -vvvvv</code>) a vault file that was identical to file that decrypted OK on macOS 10.13 using Python 3.7.2 with same Ansible versions.</p>
  
  <p>Upgrading to Python 3.7.3 on Ubuntu (using <code>apt-get install python3.7</code> on 18.04) fixed this.</p>
  
  <p>Your issue may be different, but if on Python 3.6 or lower, I would try upgrading to 3.7.</p>
  
Answers: CC BY-SA 4.0
Answers: 2021-05-18T18:29:29.620Z
Answers: I can confirm a similar behavior: I started an `ansible` project using python3.* in a virtual environment on OSX; I then cloned it onto an Ubuntu 20.04LTS machine and started using the `vault-keyring-client.py` script to pull my vault password from my system keyring, so I didn't have to store it at rest (https://github.com/ansible-collections/community.general/blob/main/scripts/vault/vault-keyring-client.py) I configured it properly, and encrypted and then viewed a file with `ansible-vault`, but simply viewing or decrypting strings/files encrypted on OSX threw an HMAC verification failure.
Answers: Life5ign
Answers: CC BY-SA 4.0
Answers: 2021-05-18T18:31:17.743Z
Answers: I guess I need to re-encrypt all the files and strings that were originally encrypted on the OSX machine.  I am using a `pyenv` python 3.* in a virtual environment on both machines, so I'm a little confused
Answers: Life5ign
Answers: CC BY-SA 4.0
Answers: 2021-05-19T05:35:17.613Z
Answers: @Life5ign Interesting - which versions of Python are you using on macOS and Ubuntu?  If not the same, can you try 3.7 on both?  This would help diagnose if it's a Python version issue or macOS vs Ubuntu difference.
Answers: RichVel
Answers: CC BY-SA 4.0
Answers: 2019-09-19T08:27:49.273Z
Answers: 2019-09-19T08:27:49.273Z
Answers: RichVel
Answers: <p>According to the <a href="http://docs.ansible.com/ansible/playbooks_vault.html" rel="nofollow noreferrer">docs</a>, </p>
  
  <blockquote>
    <p>You can also set ANSIBLE_VAULT_PASSWORD_FILEenvironment variable, e.g. ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txtand Ansible will automatically search for the password in that file.</p>
  </blockquote>
  
  <p>Ensures that you are using the exact same case. </p>
  
Answers: CC BY-SA 3.0
Answers: 2017-04-02T20:58:21.057Z
Answers: You are'missing the question, it is about configuration file property specially, it is stated literally in the question, read it again carefully
Answers: Tensibai
Answers: CC BY-SA 3.0
Answers: 2017-04-02T15:39:54.527Z
Answers: 2017-04-02T15:39:54.527Z
Answers: Findarato
Body: <p>Follow-up to this <a href="https://devops.stackexchange.com/q/703/210">Q&amp;A</a>.</p>
  
  <p>According to this and this documentation it should be possible to define a default vault password file by specifying <code>vault_password_file = ~/.vault_pass.txt</code> in one of the following files:</p>
  
  <blockquote>
  <pre><code>* ANSIBLE_CONFIG (an environment variable)
  * ansible.cfg (in the current directory)
  * .ansible.cfg (in the home directory)
  * /etc/ansible/ansible.cfg
  </code></pre>
  </blockquote>
  
  <p>Although the password file exists and the log indicates that the ansible.cfg is used that contains the definition, the decryption fails:</p>
  
  <pre><code>user@host$
  Using /etc/ansible/ansible.cfg as config file
  ERROR! Decryption failed on /path/to/ansible/group_vars/production/vault
  </code></pre>
  
  <p><strong>Discussion</strong></p>
  
  <ul>
  <li><blockquote>
    <p>Is the pass correct for this vault?</p>
  </blockquote></li>
  </ul>
  
  <p>Yes. When ansible is run using <code>--vault-password-file=~/.vault_pass.txt</code> the decryption succeeds.</p>
  
  <ul>
  <li><blockquote>
    <p>Just so that we're clear - the name of the environment variable is <code>ANSIBLE_VAULT_PASSWORD_FILE</code>, correct?</p>
  </blockquote></li>
  </ul>
  
  <p>No. When this variable is used it works, but the aim is to set it in the ansible.cfg by setting <code>/etc/ansible/ansible.cfg</code>.</p>
  
  <ul>
  <li><blockquote>
    <p>What Ansible version is used?</p>
  </blockquote>
  
  <pre><code>user@host:/dir$ ansible --version
  ansible 2.2.2.0
      config file = /etc/ansible/ansible.cfg
      configured module search path = Default w/o overrides
  </code></pre></li>
  <li><blockquote>
    <p>Does using a full path in the config works?</p>
  </blockquote></li>
  </ul>
  
  <p>The decryption failes as well when the full path instead of <code>~</code>, i.e. <code>/home/user/.vault_pass.txt</code> was specified.</p>
  
Comments: CC BY-SA 3.0
Comments: 2017-03-30T08:18:01.783Z
Comments: Just so that we're clear - the name of the environment variable is `ANSIBLE_VAULT_PASSWORD_FILE`, correct?
Comments: 13dimitar
Comments: CC BY-SA 3.0
Comments: 2017-03-30T10:05:18.477Z
Comments: And what's the output of `echo $ANSIBLE_VAULT_PASSWORD_FILE`?
Comments: 13dimitar
Comments: CC BY-SA 3.0
Comments: 2017-03-30T10:08:27.957Z
Comments: it is empty because I try to use `vault_password_file = ~/.vault_pass.txt`
Comments: 030
Comments: CC BY-SA 3.0
Comments: 2017-03-30T10:16:57.803Z
Comments: variable names are case sensitive
Comments: 13dimitar
Comments: CC BY-SA 3.0
Comments: 2017-03-30T11:40:35.400Z
Comments: This is set in the ansible.cfg. I am not using an environment variable
Comments: 030
Comments: CC BY-SA 3.0
Comments: 2017-03-30T17:15:57.567Z
Comments: Definitely a strange scenario. Do you have any other non-default variables in /etc/ansible/ansible.cfg that *are* being set correctly? And to confirm, you ran this in full verbosity (-vvv) and there is no additional output between "Using /etc/ansible/ansible.cfg as config file" and "ERROR", right? I couldn't find this exact issue in Github, but even without a smoking gun, consider trying this in Ansible 2.3
Comments: Woodland
Comments: CC BY-SA 3.0
Comments: 2017-04-03T06:39:06.547Z
Comments: Are you using the ```vault_password_file = /path/to/file``` under ```[defaults]``` in your config file?
Comments: sanzante
Tags: <ansible-vault>
Title: Why could the encrypted Ansible files not be decrypted although the vault password file has been set?
UserDisplayName: 030
ThreadText: # Why could the encrypted Ansible files not be decrypted although the vault password file has been set?
  
  (Asked by: username_0 on 2017-03-30)
  
  Follow-up to this [Q&A](https://devops.stackexchange.com/q/703/210).
  
  According to this and this documentation it should be possible to define a default vault password file by specifying `vault_password_file = ~/.vault_pass.txt` in one of the following files:
  
  > ```
  > * ANSIBLE_CONFIG (an environment variable)
  > * ansible.cfg (in the current directory)
  > * .ansible.cfg (in the home directory)
  > * /etc/ansible/ansible.cfg
  >
  > ```
  
  Although the password file exists and the log indicates that the ansible.cfg is used that contains the definition, the decryption fails:
  
  ```
  user@host$
  Using /etc/ansible/ansible.cfg as config file
  ERROR! Decryption failed on /path/to/ansible/group_vars/production/vault
  
  ```
  
  **Discussion**
  
  * > Is the pass correct for this vault?
  
  Yes. When ansible is run using `--vault-password-file=~/.vault_pass.txt` the decryption succeeds.
  
  * > Just so that we're clear - the name of the environment variable is `ANSIBLE_VAULT_PASSWORD_FILE`, correct?
  
  No. When this variable is used it works, but the aim is to set it in the ansible.cfg by setting `/etc/ansible/ansible.cfg`.
  
  * > What Ansible version is used?
  
    ```
    user@host:/dir$ ansible --version
    ansible 2.2.2.0
        config file = /etc/ansible/ansible.cfg
        configured module search path = Default w/o overrides
  
    ```
  * > Does using a full path in the config works?
  
  The decryption failes as well when the full path instead of `~`, i.e. `/home/user/.vault_pass.txt` was specified.
  
  **Tags:** ansible-vault
  
  > **Comments:**
  > **username_1**: Just so that we're clear - the name of the environment variable is `ANSIBLE_VAULT_PASSWORD_FILE`, correct?  
  > **username_1**: And what's the output of `echo $ANSIBLE_VAULT_PASSWORD_FILE`?  
  > **username_0**: it is empty because I try to use `vault_password_file = ~/.vault_pass.txt`  
  > **username_1**: variable names are case sensitive  
  > **username_0**: This is set in the ansible.cfg. I am not using an environment variable  
  > **username_2**: Definitely a strange scenario. Do you have any other non-default variables in /etc/ansible/ansible.cfg that *are* being set correctly? And to confirm, you ran this in full verbosity (-vvv) and there is no additional output between "Using /etc/ansible/ansible.cfg as config file" and "ERROR", right? I couldn't find this exact issue in Github, but even without a smoking gun, consider trying this in Ansible 2.3  
  > **username_3**: Are you using the ```vault_password_file = /path/to/file``` under ```[defaults]``` in your config file?  
  
  ---
  
  ## 3 answers
  
  ### Answer by username_0 on 2017-04-14. Score: 1 | Accepted answer
  
  It is unclear why it failed, but setting `vault_password_file = ~/.vault_pass.txt` in `/etc/ansible/ansible.cfg` was sufficient.
  
  
  ---
  
  ### Answer by username_4 on 2019-09-19. Score: 2
  
  I found an issue with Ansible/Python causing a failure to decrypt.
  
  Specifically, Ansible 2.7.10 and 2.7.13 under Python 3.6.8 on Ubuntu 18.04 would not decrypt (using `ansible-vault edit -vvvvv`) a vault file that was identical to file that decrypted OK on macOS 10.13 using Python 3.7.2 with same Ansible versions.
  
  Upgrading to Python 3.7.3 on Ubuntu (using `apt-get install python3.7` on 18.04) fixed this.
  
  Your issue may be different, but if on Python 3.6 or lower, I would try upgrading to 3.7.
  
  > **Comments:**
  > **username_5**: I can confirm a similar behavior: I started an `ansible` project using python3.* in a virtual environment on OSX; I then cloned it onto an Ubuntu 20.04LTS machine and started using the `vault-keyring-client.py` script to pull my vault password from my system keyring, so I didn't have to store it at rest (https://github.com/ansible-collections/community.general/blob/main/scripts/vault/vault-keyring-client.py) I configured it properly, and encrypted and then viewed a file with `ansible-vault`, but simply viewing or decrypting strings/files encrypted on OSX threw an HMAC verification failure.  
  > **username_5**: I guess I need to re-encrypt all the files and strings that were originally encrypted on the OSX machine.  I am using a `pyenv` python 3.* in a virtual environment on both machines, so I'm a little confused  
  > **username_4**: @username_5 Interesting - which versions of Python are you using on macOS and Ubuntu?  If not the same, can you try 3.7 on both?  This would help diagnose if it's a Python version issue or macOS vs Ubuntu difference.  
  
  ---
  
  ### Answer by username_6 on 2017-04-02. Score: -1
  
  According to the [docs](http://docs.ansible.com/ansible/playbooks_vault.html),
  
  > You can also set ANSIBLE\_VAULT\_PASSWORD\_FILEenvironment variable, e.g. ANSIBLE\_VAULT\_PASSWORD\_FILE=~/.vault\_pass.txtand Ansible will automatically search for the password in that file.
  
  Ensures that you are using the exact same case.
  
  > **Comments:**
  > **username_7**: You are'missing the question, it is about configuration file property specially, it is stated literally in the question, read it again carefully  
  
  ---
  
  