AnsibleByExample

Ansible SSH Password Auth — sshpass

Beginneransibletroubleshootingsshlinux
2024-01-014By Luca Berton

Lesson 1 of 20 in Production Playbooks

Production Playbooks and Troubleshooting — full curriculum
  1. 1. Advanced Playbook Structure & Execution Strategies
  2. 2. Deep Dive: Variable Precedence & Best Practices
  3. 3. Jinja2 Templating Beyond Basics
  4. 4. Advanced Conditionals
  5. 5. Loops Masterclass
  6. 6. Blocks, Rescue, Always (Error Handling)
  7. 7. Handlers Advanced
  8. 8. Change Control: changed_when, failed_when
  9. 9. Tags and Selective Runs
  10. 10. Performance Tuning
  11. 11. Delegation Patterns
  12. 12. Local Actions and Remote Actions
  13. 13. Dynamic Inventory & Runtime Host Management
  14. 14. Includes & Imports (Structuring Large Codebases)
  15. 15. Role Design Patterns
  16. 16. Ansible Galaxy & Collections in Real Projects
  17. 17. Working with APIs (uri + JSON workflows)
  18. 18. Testing and Linting (Quality Gates)
  19. 19. Advanced Debugging Playbook Failures
  20. 20. Capstone: Multi-Stage Deployment
View path overview →

Introduction

When you run an Ansible playbook using SSH password authentication, you may encounter this error:

fatal: [myhost]: FAILED! => {"msg": "to use the ssh connection type with passwords
or pkcs11_provider, you must install the sshpass program"}

This means Ansible needs the sshpass utility to pass passwords non-interactively to SSH. Here's how to fix it — and why SSH keys are the better long-term solution.

Quick Fix: Install sshpass

RHEL / CentOS / Fedora

sudo dnf install sshpass
# Or on CentOS 7
sudo yum install sshpass

Ubuntu / Debian

sudo apt-get install sshpass

macOS

brew install hudochenkov/sshpass/sshpass
# Or
brew install esolitos/ipa/sshpass

Note: Homebrew doesn't include sshpass in the default tap because it encourages SSH key usage. Use a third-party tap as shown above.

Arch Linux

sudo pacman -S sshpass

Verify Installation

sshpass -V
# sshpass 1.09

Using SSH Passwords in Ansible

Method 1: Command Line (Testing Only)

ansible all -m ping -i inventory --ask-pass
# or
ansible-playbook playbook.yml --ask-pass

Method 2: Inventory Variables

# inventory.ini
[servers]
web01 ansible_host=192.168.1.10 ansible_user=deploy ansible_ssh_pass={{ vault_ssh_password }}

Never store plaintext passwords in inventory files. Use Ansible Vault:

# Create encrypted variable file
ansible-vault create group_vars/servers/vault.yml

# group_vars/servers/vault.yml (encrypted)
vault_ssh_password: "YourSecurePassword"

# Run with vault
ansible-playbook playbook.yml --ask-vault-pass

Method 3: ansible.cfg

# ansible.cfg
[defaults]
ask_pass = True

Why SSH Keys Are Better

FeaturePassword AuthSSH Key Auth
SecurityWeaker (brute-forceable)Stronger (cryptographic)
ConvenienceRequires sshpassBuilt into SSH
AutomationNeeds vault for secretsKey file on controller
Audit trailShared passwordsUnique keys per user
RevocationChange password everywhereRemove one key

Switch to SSH Keys

# Generate key pair (if you don't have one)
ssh-keygen -t ed25519 -C "ansible@controller"

# Distribute to all hosts
ssh-copy-id deploy@web01.example.com
ssh-copy-id deploy@web02.example.com

# Test without password
ansible all -m ping -i inventory

Ansible Inventory with Keys

[servers]
web01 ansible_host=192.168.1.10

[servers:vars]
ansible_user=deploy
ansible_ssh_private_key_file=~/.ssh/ansible_key
# No password needed!

Troubleshooting

sshpass Installed but Still Failing

Check if Ansible can find it:

which sshpass
# /usr/bin/sshpass

# If installed in non-standard location
export PATH="/usr/local/bin:$PATH"

Password Prompt Hangs

sshpass may hang if the host key isn't accepted. Fix:

# Accept host key first
ssh-keyscan web01.example.com >> ~/.ssh/known_hosts

Or in ansible.cfg:

[defaults]
host_key_checking = False  # Only for testing!

macOS: "sshpass not found" After Install

# Check Homebrew path
echo $PATH | grep homebrew
# Ensure /opt/homebrew/bin is in PATH (Apple Silicon)
export PATH="/opt/homebrew/bin:$PATH"

Permission Denied Despite Correct Password

# Verify password works manually
sshpass -p 'YourPassword' ssh deploy@web01.example.com whoami

# Check SSH server allows password auth
ssh -v deploy@web01.example.com 2>&1 | grep "Authentications that can continue"

On the remote server, verify /etc/ssh/sshd_config:

PasswordAuthentication yes

PKCS11 Provider Error

The same error appears with PKCS11 hardware tokens. Install sshpass or configure the PKCS11 provider path:

[servers:vars]
ansible_ssh_extra_args="-o PKCS11Provider=/usr/lib/libykcs11.so"

Playbook Example with Password Auth

---
- name: Test SSH password connectivity
  hosts: servers
  gather_facts: false
  tasks:
    - name: Ping hosts
      ansible.builtin.ping:

    - name: Show hostname
      ansible.builtin.command: hostname
      register: result

    - name: Display result
      ansible.builtin.debug:
        var: result.stdout

ansible-playbook test.yml --ask-pass --ask-vault-pass

Conclusion

Install sshpass to fix the immediate error: dnf install sshpass (RHEL), apt install sshpass (Ubuntu), or brew install esolitos/ipa/sshpass (macOS). Then store passwords in Ansible Vault — never in plaintext. For production environments, switch to SSH key authentication: generate a key pair with ssh-keygen, distribute with ssh-copy-id, and remove the password dependency entirely.

All Tutorials