diff --git a/bin/ansible b/bin/ansible
index 0b0b536679c..11b592ee980 100755
--- a/bin/ansible
+++ b/bin/ansible
@@ -75,6 +75,7 @@ class Cli(object):
 
         sshpass = None
         sudopass = None
+        options.ask_pass = options.ask_pass or C.DEFAULT_ASK_PASS
         if options.ask_pass:
             sshpass = getpass.getpass(prompt="SSH password: ")
         if options.ask_sudo_pass:
diff --git a/bin/ansible-playbook b/bin/ansible-playbook
index 3587fa4662a..bd5eb6c224c 100755
--- a/bin/ansible-playbook
+++ b/bin/ansible-playbook
@@ -70,6 +70,7 @@ def main(args):
     sshpass = None
     sudopass = None
     if not options.listhosts:
+        options.ask_pass = options.ask_pass or C.DEFAULT_ASK_PASS
         if options.ask_pass:
             sshpass = getpass.getpass(prompt="SSH password: ")
         if options.ask_sudo_pass:
diff --git a/examples/ansible.cfg b/examples/ansible.cfg
index 0eb27d9b78f..9ce83ce6d29 100644
--- a/examples/ansible.cfg
+++ b/examples/ansible.cfg
@@ -46,6 +46,11 @@ poll_interval=15
 
 sudo_user=root
 
+# if set, ansible will always prompt for the ssh-password (-k)
+# can also be set by the environment variable ANSIBLE_ASK_PASS
+
+# ask_pass=True
+
 # connection to use when -c <connection_type> is not specified
 
 transport=paramiko
diff --git a/lib/ansible/constants.py b/lib/ansible/constants.py
index a978c496683..db660b5b28a 100644
--- a/lib/ansible/constants.py
+++ b/lib/ansible/constants.py
@@ -76,6 +76,7 @@ DEFAULT_MODULE_ARGS       = get_config(p, DEFAULTS, 'module_args',      'ANSIBLE
 DEFAULT_TIMEOUT           = get_config(p, DEFAULTS, 'timeout',          'ANSIBLE_TIMEOUT',          10)
 DEFAULT_POLL_INTERVAL     = get_config(p, DEFAULTS, 'poll_interval',    'ANSIBLE_POLL_INTERVAL',    15)
 DEFAULT_REMOTE_USER       = get_config(p, DEFAULTS, 'remote_user',      'ANSIBLE_REMOTE_USER',      active_user)
+DEFAULT_ASK_PASS          = get_config(p, DEFAULTS, 'ask_pass',  'ANSIBLE_ASK_PASS',    False)
 DEFAULT_PRIVATE_KEY_FILE  = shell_expand_path(get_config(p, DEFAULTS, 'private_key_file', 'ANSIBLE_PRIVATE_KEY_FILE', None))
 DEFAULT_SUDO_USER         = get_config(p, DEFAULTS, 'sudo_user',        'ANSIBLE_SUDO_USER',        'root')
 DEFAULT_REMOTE_PORT       = int(get_config(p, DEFAULTS, 'remote_port',      'ANSIBLE_REMOTE_PORT',      22))