ansible_password vs ansible_ssh_pass: SSH Authentication

ansible_password vs ansible_ssh_pass

In Ansible, both ansible_password and ansible_ssh_pass configure the SSH password for connecting to remote hosts. Here's what you need to know:

Variable	Status	Purpose
`ansible_password`	Current (recommended)	SSH password for the connection plugin
`ansible_ssh_pass`	Legacy alias	Old name, still works but deprecated

Since Ansible 2.0, ansible_password is the preferred variable name. The old ansible_ssh_pass still works as a backward-compatible alias.

Setting the SSH Password in Inventory

INI Format

[webservers]
web1 ansible_host=192.168.1.10 ansible_user=deploy ansible_password=secretpass
web2 ansible_host=192.168.1.11 ansible_user=deploy ansible_password=secretpass

[webservers:vars]
ansible_connection=ssh

YAML Format

all:
  children:
    webservers:
      hosts:
        web1:
          ansible_host: 192.168.1.10
          ansible_user: deploy
          ansible_password: "{{ vault_ssh_password }}"
        web2:
          ansible_host: 192.168.1.11
          ansible_user: deploy
          ansible_password: "{{ vault_ssh_password }}"

Security Best Practice: Use Ansible Vault

Never store passwords in plain text. Use Ansible Vault to encrypt sensitive variables:

# Create an encrypted variables file
ansible-vault create group_vars/webservers/vault.yml

Inside the vault file:

vault_ssh_password: "your-actual-password"

Reference it in your inventory or playbook:

ansible_password: "{{ vault_ssh_password }}"

Run the playbook with vault:

ansible-playbook playbook.yml --ask-vault-pass

Variable	Purpose
`ansible_password`	SSH password
`ansible_user`	SSH username
`ansible_become_pass`	Sudo/privilege escalation password
`ansible_ssh_private_key_file`	Path to SSH private key
`ansible_connection`	Connection type (ssh, local, winrm)
`ansible_port`	SSH port (default: 22)

Prerequisite: sshpass

For password-based SSH connections, you need sshpass installed on the Ansible control node:

# Debian/Ubuntu
sudo apt install sshpass

# RHEL/CentOS/Fedora
sudo dnf install sshpass

Recommendation: Use SSH Keys Instead

Password-based authentication works but SSH keys are more secure and convenient:

# Generate a key pair
ssh-keygen -t ed25519 -C "ansible"

# Copy the public key to remote hosts
ssh-copy-id deploy@192.168.1.10

Then remove ansible_password from your inventory entirely — Ansible will use key-based auth automatically.

Example Playbook

---
- name: Test SSH password authentication
  hosts: webservers
  tasks:
    - name: Verify connectivity
      ansible.builtin.ping:

    - name: Show connection info
      ansible.builtin.debug:
        msg: "Connected to {{ inventory_hostname }} as {{ ansible_user }}"

Run it:

ansible-playbook playbook.yml --ask-vault-pass

Common Errors

"to use the 'ssh' connection type with passwords, you must install the sshpass program"

Install sshpass:

sudo apt install sshpass  # Debian/Ubuntu
sudo dnf install sshpass  # RHEL/Fedora

"Permission denied (publickey,password)"

Check that:

The password is correct
The remote host allows password authentication (PasswordAuthentication yes in /etc/ssh/sshd_config)
The username is correct

Learn more about Ansible connections and security in our 800+ tutorials and Learning Paths.