SSH: Implement and make use of RFC 4256.

There is now at least one Linux distribution (openSUSE 12.3) that
disables the "password" authentication method in its default
sshd_config, while others allow it, but disable "keyboard-interactive".
This patch tackles the problem as follows:
    1) Implement RFC 4256 ("keyboard-interactive") and make this method
available in the API.
    2) In addition, the API offers to try both password-based methods
one after the other, until one has succeeded or all have failed.
    3) Dialogs continue to offer just the choice between "Password" and
"Key", as to not confuse users. Internally, "Password" uses the feature
described in 2).

Task-number: QTCREATORBUG-9568
Change-Id: Ic81bd5d2dc4b1332ea1a8be938c19811c21a9087
Reviewed-by: hjk <hjk121@nokiamail.com>
Reviewed-by: Christian Kandeler <christian.kandeler@digia.com>

28 files changed, 219 insertions, 73 deletions

diff --git a/src/libs/ssh/sshcapabilities.cpp b/src/libs/ssh/sshcapabilities.cpp
index c92af1ef63..635d9fd392 100644
--- a/src/libs/ssh/sshcapabilities.cpp
+++ b/src/libs/ssh/sshcapabilities.cpp
@@ -78,10 +78,6 @@ const QList<QByteArray> SshCapabilities::CompressionAlgorithms
 
 const QByteArray SshCapabilities::SshConnectionService("ssh-connection");
 
-const QByteArray SshCapabilities::PublicKeyAuthMethod("publickey");
-const QByteArray SshCapabilities::PasswordAuthMethod("password");
-
-
 QByteArray SshCapabilities::findBestMatch(const QList<QByteArray> &myCapabilities,
     const QList<QByteArray> &serverCapabilities)
 {
diff --git a/src/libs/ssh/sshcapabilities_p.h b/src/libs/ssh/sshcapabilities_p.h
index 97c2428beb..9355026c90 100644
--- a/src/libs/ssh/sshcapabilities_p.h
+++ b/src/libs/ssh/sshcapabilities_p.h
@@ -59,9 +59,6 @@ public:
 
     static const QByteArray SshConnectionService;
 
-    static const QByteArray PublicKeyAuthMethod;
-    static const QByteArray PasswordAuthMethod;
-
     static QByteArray findBestMatch(const QList<QByteArray> &myCapabilities,
         const QList<QByteArray> &serverCapabilities);
 };
diff --git a/src/libs/ssh/sshconnection.cpp b/src/libs/ssh/sshconnection.cpp
index 7d5ca7b584..4ab8b778fd 100644
--- a/src/libs/ssh/sshconnection.cpp
+++ b/src/libs/ssh/sshconnection.cpp
@@ -81,7 +81,7 @@ namespace {
 
 
 SshConnectionParameters::SshConnectionParameters() :
-    timeout(0),  authenticationType(AuthenticationByKey), port(0)
+    timeout(0),  authenticationType(AuthenticationTypePublicKey), port(0)
 {
     options |= SshIgnoreDefaultProxy;
     options |= SshEnableStrictConformanceChecks;
@@ -91,7 +91,7 @@ static inline bool equals(const SshConnectionParameters &p1, const SshConnection
 {
     return p1.host == p2.host && p1.userName == p2.userName
             && p1.authenticationType == p2.authenticationType
-            && (p1.authenticationType == SshConnectionParameters::AuthenticationByPassword ?
+            && (p1.authenticationType == SshConnectionParameters::AuthenticationTypePassword ?
                     p1.password == p2.password : p1.privateKeyFile == p2.privateKeyFile)
             && p1.timeout == p2.timeout && p1.port == p2.port;
 }
@@ -255,8 +255,11 @@ void SshConnectionPrivate::setupPacketHandlers()
     setupPacketHandler(SSH_MSG_SERVICE_ACCEPT,
         StateList() << UserAuthServiceRequested,
         &This::handleServiceAcceptPacket);
-    setupPacketHandler(SSH_MSG_USERAUTH_PASSWD_CHANGEREQ,
-        StateList() << UserAuthRequested, &This::handlePasswordExpiredPacket);
+    if (m_connParams.authenticationType == SshConnectionParameters::AuthenticationTypePassword
+            || m_connParams.authenticationType == SshConnectionParameters::AuthenticationTypeTryAllPasswordBasedMethods) {
+        setupPacketHandler(SSH_MSG_USERAUTH_PASSWD_CHANGEREQ,
+                StateList() << UserAuthRequested, &This::handlePasswordExpiredPacket);
+    }
     setupPacketHandler(SSH_MSG_GLOBAL_REQUEST,
         StateList() << ConnectionEstablished, &This::handleGlobalRequest);
 
@@ -267,6 +270,11 @@ void SshConnectionPrivate::setupPacketHandlers()
         &This::handleUserAuthSuccessPacket);
     setupPacketHandler(SSH_MSG_USERAUTH_FAILURE, authReqList,
         &This::handleUserAuthFailurePacket);
+    if (m_connParams.authenticationType == SshConnectionParameters::AuthenticationTypeKeyboardInteractive
+            || m_connParams.authenticationType == SshConnectionParameters::AuthenticationTypeTryAllPasswordBasedMethods) {
+        setupPacketHandler(SSH_MSG_USERAUTH_INFO_REQUEST, authReqList,
+                &This::handleUserAuthInfoRequestPacket);
+    }
 
     const StateList connectedList
         = StateList() << ConnectionEstablished;
@@ -442,14 +450,13 @@ void SshConnectionPrivate::handleCurrentPacket()
 
     QHash<SshPacketType, HandlerInStates>::ConstIterator it
         = m_packetHandlers.find(m_incomingPacket.type());
-    if (it == m_packetHandlers.end()) {
+    if (it == m_packetHandlers.constEnd()) {
         m_sendFacility.sendMsgUnimplementedPacket(m_incomingPacket.serverSeqNr());
         return;
     }
     if (!it.value().first.contains(m_state)) {
-        throw SshServerException(SSH_DISCONNECT_PROTOCOL_ERROR,
-            "Unexpected packet.", tr("Unexpected packet of type %1.")
-            .arg(m_incomingPacket.type()));
+        handleUnexpectedPacket();
+        return;
     }
     (this->*it.value().second)();
 }
@@ -512,31 +519,71 @@ void SshConnectionPrivate::handleNewKeysPacket()
 
 void SshConnectionPrivate::handleServiceAcceptPacket()
 {
-    if (m_connParams.authenticationType == SshConnectionParameters::AuthenticationByPassword) {
-        m_sendFacility.sendUserAuthByPwdRequestPacket(m_connParams.userName.toUtf8(),
-            SshCapabilities::SshConnectionService, m_connParams.password.toUtf8());
-    } else {
-        m_sendFacility.sendUserAuthByKeyRequestPacket(m_connParams.userName.toUtf8(),
-            SshCapabilities::SshConnectionService);
+    switch (m_connParams.authenticationType) {
+    case SshConnectionParameters::AuthenticationTypeTryAllPasswordBasedMethods:
+        m_triedAllPasswordBasedMethods = false;
+        // Fall-through.
+    case SshConnectionParameters::AuthenticationTypePassword:
+        m_sendFacility.sendUserAuthByPasswordRequestPacket(m_connParams.userName.toUtf8(),
+                SshCapabilities::SshConnectionService, m_connParams.password.toUtf8());
+        break;
+    case SshConnectionParameters::AuthenticationTypeKeyboardInteractive:
+        m_sendFacility.sendUserAuthByKeyboardInteractiveRequestPacket(m_connParams.userName.toUtf8(),
+                SshCapabilities::SshConnectionService);
+        break;
+    case SshConnectionParameters::AuthenticationTypePublicKey:
+        m_sendFacility.sendUserAuthByPublicKeyRequestPacket(m_connParams.userName.toUtf8(),
+                SshCapabilities::SshConnectionService);
+        break;
     }
     m_state = UserAuthRequested;
 }
 
 void SshConnectionPrivate::handlePasswordExpiredPacket()
 {
-    if (m_connParams.authenticationType == SshConnectionParameters::AuthenticationByKey) {
-        throw SSH_SERVER_EXCEPTION(SSH_DISCONNECT_PROTOCOL_ERROR,
-            "Got SSH_MSG_USERAUTH_PASSWD_CHANGEREQ, but did not use password.");
+    if (m_connParams.authenticationType == SshConnectionParameters::AuthenticationTypeTryAllPasswordBasedMethods
+            && m_triedAllPasswordBasedMethods) {
+        // This means we just tried to authorize via "keyboard-interactive", in which case
+        // this type of packet is not allowed.
+        handleUnexpectedPacket();
+        return;
     }
-
     throw SshClientException(SshAuthenticationError, tr("Password expired."));
 }
 
+void SshConnectionPrivate::handleUserAuthInfoRequestPacket()
+{
+    if (m_connParams.authenticationType == SshConnectionParameters::AuthenticationTypeTryAllPasswordBasedMethods
+            && !m_triedAllPasswordBasedMethods) {
+        // This means we just tried to authorize via "password", in which case
+        // this type of packet is not allowed.
+        handleUnexpectedPacket();
+        return;
+    }
+
+    const SshUserAuthInfoRequestPacket requestPacket
+            = m_incomingPacket.extractUserAuthInfoRequest();
+    QStringList responses;
+    responses.reserve(requestPacket.prompts.count());
+
+    // Not very interactive, admittedly, but we don't want to be for now.
+    for (int i = 0;  i < requestPacket.prompts.count(); ++i)
+        responses << m_connParams.password;
+    m_sendFacility.sendUserAuthInfoResponsePacket(responses);
+}
+
 void SshConnectionPrivate::handleUserAuthBannerPacket()
 {
     emit dataAvailable(m_incomingPacket.extractUserAuthBanner().message);
 }
 
+void SshConnectionPrivate::handleUnexpectedPacket()
+{
+    throw SshServerException(SSH_DISCONNECT_PROTOCOL_ERROR,
+                             "Unexpected packet.", tr("Unexpected packet of type %1.")
+                             .arg(m_incomingPacket.type()));
+}
+
 void SshConnectionPrivate::handleGlobalRequest()
 {
     m_sendFacility.sendRequestFailurePacket();
@@ -554,9 +601,20 @@ void SshConnectionPrivate::handleUserAuthSuccessPacket()
 
 void SshConnectionPrivate::handleUserAuthFailurePacket()
 {
+    // TODO: Evaluate "authentications that can continue" field and act on it.
+    if (m_connParams.authenticationType
+            == SshConnectionParameters::AuthenticationTypeTryAllPasswordBasedMethods
+        && !m_triedAllPasswordBasedMethods) {
+        m_triedAllPasswordBasedMethods = true;
+        m_sendFacility.sendUserAuthByKeyboardInteractiveRequestPacket(
+                    m_connParams.userName.toUtf8(),
+                    SshCapabilities::SshConnectionService);
+        return;
+    }
+
     m_timeoutTimer.stop();
-    const QString errorMsg = m_connParams.authenticationType == SshConnectionParameters::AuthenticationByPassword
-        ? tr("Server rejected password.") : tr("Server rejected key.");
+    const QString errorMsg = m_connParams.authenticationType == SshConnectionParameters::AuthenticationTypePublicKey
+        ? tr("Server rejected key.") : tr("Server rejected password.");
     throw SshClientException(SshAuthenticationError, errorMsg);
 }
 void SshConnectionPrivate::handleDebugPacket()
@@ -698,7 +756,7 @@ void SshConnectionPrivate::connectToHost()
     m_serverHasSentDataBeforeId = false;
 
     try {
-        if (m_connParams.authenticationType == SshConnectionParameters::AuthenticationByKey)
+        if (m_connParams.authenticationType == SshConnectionParameters::AuthenticationTypePublicKey)
             createPrivateKey();
     } catch (const SshClientException &ex) {
         m_error = ex.error;
diff --git a/src/libs/ssh/sshconnection.h b/src/libs/ssh/sshconnection.h
index 9a70a02a0b..621ace3823 100644
--- a/src/libs/ssh/sshconnection.h
+++ b/src/libs/ssh/sshconnection.h
@@ -60,7 +60,15 @@ Q_DECLARE_FLAGS(SshConnectionOptions, SshConnectionOption)
 class QSSH_EXPORT SshConnectionParameters
 {
 public:
-    enum AuthenticationType { AuthenticationByPassword, AuthenticationByKey };
+    enum AuthenticationType {
+        AuthenticationTypePassword,
+        AuthenticationTypePublicKey,
+        AuthenticationTypeKeyboardInteractive,
+
+        // Some servers disable "password", others disable "keyboard-interactive".
+        AuthenticationTypeTryAllPasswordBasedMethods
+    };
+
     SshConnectionParameters();
 
     QString host;
diff --git a/src/libs/ssh/sshconnection_p.h b/src/libs/ssh/sshconnection_p.h
index 2c21a0556c..7c4e5bbbc3 100644
--- a/src/libs/ssh/sshconnection_p.h
+++ b/src/libs/ssh/sshconnection_p.h
@@ -116,9 +116,11 @@ private:
     void handleNewKeysPacket();
     void handleServiceAcceptPacket();
     void handlePasswordExpiredPacket();
+    void handleUserAuthInfoRequestPacket();
     void handleUserAuthSuccessPacket();
     void handleUserAuthFailurePacket();
     void handleUserAuthBannerPacket();
+    void handleUnexpectedPacket();
     void handleGlobalRequest();
     void handleDebugPacket();
     void handleUnimplementedPacket();
@@ -168,6 +170,7 @@ private:
     quint64 m_lastInvalidMsgSeqNr;
     QByteArray m_serverId;
     bool m_serverHasSentDataBeforeId;
+    bool m_triedAllPasswordBasedMethods;
 };
 
 } // namespace Internal
diff --git a/src/libs/ssh/sshincomingpacket.cpp b/src/libs/ssh/sshincomingpacket.cpp
index af0f20bd1e..c2cdb7b630 100644
--- a/src/libs/ssh/sshincomingpacket.cpp
+++ b/src/libs/ssh/sshincomingpacket.cpp
@@ -242,6 +242,31 @@ SshUserAuthBanner SshIncomingPacket::extractUserAuthBanner() const
     }
 }
 
+SshUserAuthInfoRequestPacket SshIncomingPacket::extractUserAuthInfoRequest() const
+{
+    Q_ASSERT(isComplete());
+    Q_ASSERT(type() == SSH_MSG_USERAUTH_INFO_REQUEST);
+
+    try {
+        SshUserAuthInfoRequestPacket msg;
+        quint32 offset = TypeOffset + 1;
+        msg.name = SshPacketParser::asUserString(m_data, &offset);
+        msg.instruction = SshPacketParser::asUserString(m_data, &offset);
+        msg.languageTag = SshPacketParser::asString(m_data, &offset);
+        const quint32 promptCount = SshPacketParser::asUint32(m_data, &offset);
+        msg.prompts.reserve(promptCount);
+        msg.echos.reserve(promptCount);
+        for (quint32 i = 0; i < promptCount; ++i) {
+            msg.prompts << SshPacketParser::asUserString(m_data, &offset);
+            msg.echos << SshPacketParser::asBool(m_data, &offset);
+        }
+        return msg;
+    } catch (SshPacketParseException &) {
+        throw SSH_SERVER_EXCEPTION(SSH_DISCONNECT_PROTOCOL_ERROR,
+            "Invalid SSH_MSG_USERAUTH_INFO_REQUEST.");
+    }
+}
+
 SshDebug SshIncomingPacket::extractDebug() const
 {
     Q_ASSERT(isComplete());
diff --git a/src/libs/ssh/sshincomingpacket_p.h b/src/libs/ssh/sshincomingpacket_p.h
index 6080e52e83..6469a7a4df 100644
--- a/src/libs/ssh/sshincomingpacket_p.h
+++ b/src/libs/ssh/sshincomingpacket_p.h
@@ -35,8 +35,7 @@
 #include "sshcryptofacility_p.h"
 #include "sshpacketparser_p.h"
 
-#include <QList>
-#include <QString>
+#include <QStringList>
 
 namespace QSsh {
 namespace Internal {
@@ -80,6 +79,15 @@ struct SshUserAuthBanner
     QByteArray language;
 };
 
+struct SshUserAuthInfoRequestPacket
+{
+    QString name;
+    QString instruction;
+    QByteArray languageTag;
+    QStringList prompts;
+    QList<bool> echos;
+};
+
 struct SshDebug
 {
     bool display;
@@ -156,6 +164,7 @@ public:
     SshKeyExchangeReply extractKeyExchangeReply(const QByteArray &pubKeyAlgo) const;
     SshDisconnect extractDisconnect() const;
     SshUserAuthBanner extractUserAuthBanner() const;
+    SshUserAuthInfoRequestPacket extractUserAuthInfoRequest() const;
     SshDebug extractDebug() const;
     SshUnimplemented extractUnimplemented() const;
 
diff --git a/src/libs/ssh/sshoutgoingpacket.cpp b/src/libs/ssh/sshoutgoingpacket.cpp
index d1c654a4a4..b4e772973e 100644
--- a/src/libs/ssh/sshoutgoingpacket.cpp
+++ b/src/libs/ssh/sshoutgoingpacket.cpp
@@ -103,7 +103,7 @@ void SshOutgoingPacket::generateServiceRequest(const QByteArray &service)
     init(SSH_MSG_SERVICE_REQUEST).appendString(service).finalize();
 }
 
-void SshOutgoingPacket::generateUserAuthByPwdRequestPacket(const QByteArray &user,
+void SshOutgoingPacket::generateUserAuthByPasswordRequestPacket(const QByteArray &user,
     const QByteArray &service, const QByteArray &pwd)
 {
     init(SSH_MSG_USERAUTH_REQUEST).appendString(user).appendString(service)
@@ -111,7 +111,7 @@ void SshOutgoingPacket::generateUserAuthByPwdRequestPacket(const QByteArray &use
         .finalize();
 }
 
-void SshOutgoingPacket::generateUserAuthByKeyRequestPacket(const QByteArray &user,
+void SshOutgoingPacket::generateUserAuthByPublicKeyRequestPacket(const QByteArray &user,
     const QByteArray &service)
 {
     init(SSH_MSG_USERAUTH_REQUEST).appendString(user).appendString(service)
@@ -123,6 +123,26 @@ void SshOutgoingPacket::generateUserAuthByKeyRequestPacket(const QByteArray &use
     finalize();
 }
 
+void SshOutgoingPacket::generateUserAuthByKeyboardInteractiveRequestPacket(const QByteArray &user,
+                                                                           const QByteArray &service)
+{
+    // RFC 4256, 3.1
+    init(SSH_MSG_USERAUTH_REQUEST).appendString(user).appendString(service)
+            .appendString("keyboard-interactive")
+            .appendString(QByteArray()) // Language tag. Deprecated and should be empty
+            .appendString(QByteArray()) // Submethods.
+            .finalize();
+}
+
+void SshOutgoingPacket::generateUserAuthInfoResponsePacket(const QStringList &responses)
+{
+    // RFC 4256, 3.4
+    init(SSH_MSG_USERAUTH_INFO_RESPONSE).appendInt(responses.count());
+    foreach (const QString &response, responses)
+        appendString(response.toUtf8());
+    finalize();
+}
+
 void SshOutgoingPacket::generateRequestFailurePacket()
 {
     init(SSH_MSG_REQUEST_FAILURE).finalize();
diff --git a/src/libs/ssh/sshoutgoingpacket_p.h b/src/libs/ssh/sshoutgoingpacket_p.h
index 03f54cb76d..6f3de1c347 100644
--- a/src/libs/ssh/sshoutgoingpacket_p.h
+++ b/src/libs/ssh/sshoutgoingpacket_p.h
@@ -34,6 +34,8 @@
 
 #include "sshpseudoterminal.h"
 
+#include <QStringList>
+
 namespace QSsh {
 namespace Internal {
 
@@ -52,10 +54,13 @@ public:
         const QByteArray &reasonString);
     void generateMsgUnimplementedPacket(quint32 serverSeqNr);
     void generateUserAuthServiceRequestPacket();
-    void generateUserAuthByPwdRequestPacket(const QByteArray &user,
+    void generateUserAuthByPasswordRequestPacket(const QByteArray &user,
         const QByteArray &service, const QByteArray &pwd);
-    void generateUserAuthByKeyRequestPacket(const QByteArray &user,
+    void generateUserAuthByPublicKeyRequestPacket(const QByteArray &user,
+        const QByteArray &service);
+    void generateUserAuthByKeyboardInteractiveRequestPacket(const QByteArray &user,
         const QByteArray &service);
+    void generateUserAuthInfoResponsePacket(const QStringList &responses);
     void generateRequestFailurePacket();
     void generateIgnorePacket();
     void generateInvalidMessagePacket();
diff --git a/src/libs/ssh/sshpacket_p.h b/src/libs/ssh/sshpacket_p.h
index ab1ac47b00..d97979a020 100644
--- a/src/libs/ssh/sshpacket_p.h
+++ b/src/libs/ssh/sshpacket_p.h
@@ -60,6 +60,8 @@ enum SshPacketType {
     SSH_MSG_USERAUTH_BANNER = 53,
     SSH_MSG_USERAUTH_PK_OK = 60,
     SSH_MSG_USERAUTH_PASSWD_CHANGEREQ = 60,
+    SSH_MSG_USERAUTH_INFO_REQUEST = 60,
+    SSH_MSG_USERAUTH_INFO_RESPONSE = 61,
 
     SSH_MSG_GLOBAL_REQUEST = 80,
     SSH_MSG_REQUEST_SUCCESS = 81,
diff --git a/src/libs/ssh/sshsendfacility.cpp b/src/libs/ssh/sshsendfacility.cpp
index 8b600009e4..572ab30482 100644
--- a/src/libs/ssh/sshsendfacility.cpp
+++ b/src/libs/ssh/sshsendfacility.cpp
@@ -109,17 +109,30 @@ void SshSendFacility::sendUserAuthServiceRequestPacket()
     sendPacket();
 }
 
-void SshSendFacility::sendUserAuthByPwdRequestPacket(const QByteArray &user,
+void SshSendFacility::sendUserAuthByPasswordRequestPacket(const QByteArray &user,
     const QByteArray &service, const QByteArray &pwd)
 {
-    m_outgoingPacket.generateUserAuthByPwdRequestPacket(user, service, pwd);
+    m_outgoingPacket.generateUserAuthByPasswordRequestPacket(user, service, pwd);
     sendPacket();
     }
 
-void SshSendFacility::sendUserAuthByKeyRequestPacket(const QByteArray &user,
+void SshSendFacility::sendUserAuthByPublicKeyRequestPacket(const QByteArray &user,
     const QByteArray &service)
 {
-    m_outgoingPacket.generateUserAuthByKeyRequestPacket(user, service);
+    m_outgoingPacket.generateUserAuthByPublicKeyRequestPacket(user, service);
+    sendPacket();
+}
+
+void SshSendFacility::sendUserAuthByKeyboardInteractiveRequestPacket(const QByteArray &user,
+                                                                     const QByteArray &service)
+{
+    m_outgoingPacket.generateUserAuthByKeyboardInteractiveRequestPacket(user, service);
+    sendPacket();
+}
+
+void SshSendFacility::sendUserAuthInfoResponsePacket(const QStringList &responses)
+{
+    m_outgoingPacket.generateUserAuthInfoResponsePacket(responses);
     sendPacket();
 }
 
diff --git a/src/libs/ssh/sshsendfacility_p.h b/src/libs/ssh/sshsendfacility_p.h
index 9f58168bc2..2b65d24bb7 100644
--- a/src/libs/ssh/sshsendfacility_p.h
+++ b/src/libs/ssh/sshsendfacility_p.h
@@ -33,6 +33,8 @@
 #include "sshcryptofacility_p.h"
 #include "sshoutgoingpacket_p.h"
 
+#include <QStringList>
+
 QT_BEGIN_NAMESPACE
 class QTcpSocket;
 QT_END_NAMESPACE
@@ -59,10 +61,13 @@ public:
         const QByteArray &reasonString);
     void sendMsgUnimplementedPacket(quint32 serverSeqNr);
     void sendUserAuthServiceRequestPacket();
-    void sendUserAuthByPwdRequestPacket(const QByteArray &user,
+    void sendUserAuthByPasswordRequestPacket(const QByteArray &user,
         const QByteArray &service, const QByteArray &pwd);
-    void sendUserAuthByKeyRequestPacket(const QByteArray &user,
+    void sendUserAuthByPublicKeyRequestPacket(const QByteArray &user,
+        const QByteArray &service);
+    void sendUserAuthByKeyboardInteractiveRequestPacket(const QByteArray &user,
         const QByteArray &service);
+    void sendUserAuthInfoResponsePacket(const QStringList &responses);
     void sendRequestFailurePacket();
     void sendIgnorePacket();
     void sendInvalidPacket();
diff --git a/src/plugins/debugger/debuggerplugin.cpp b/src/plugins/debugger/debuggerplugin.cpp
index 5b5793b426..68a42784ff 100644
--- a/src/plugins/debugger/debuggerplugin.cpp
+++ b/src/plugins/debugger/debuggerplugin.cpp
@@ -1808,7 +1808,8 @@ void DebuggerPluginPrivate::startRemoteEngine()
     sp.connParams.password = dlg.password();
 
     sp.connParams.timeout = 5;
-    sp.connParams.authenticationType = QSsh::SshConnectionParameters::AuthenticationByPassword;
+    sp.connParams.authenticationType
+            = QSsh::SshConnectionParameters::AuthenticationTypeTryAllPasswordBasedMethods;
     sp.connParams.port = 22;
     sp.connParams.options = QSsh::SshIgnoreDefaultProxy;
 
diff --git a/src/plugins/madde/maemodeviceconfigwizard.cpp b/src/plugins/madde/maemodeviceconfigwizard.cpp
index f80b3b4169..0b352549e2 100644
--- a/src/plugins/madde/maemodeviceconfigwizard.cpp
+++ b/src/plugins/madde/maemodeviceconfigwizard.cpp
@@ -441,7 +441,7 @@ private:
         m_ui->passwordLineEdit->setEnabled(false);
         m_ui->deployButton->setEnabled(false);
         SshConnectionParameters sshParams;
-        sshParams.authenticationType = SshConnectionParameters::AuthenticationByPassword;
+        sshParams.authenticationType = SshConnectionParameters::AuthenticationTypePassword;
         sshParams.host = hostAddress();
         sshParams.port = m_wizardData.sshPort;
         sshParams.password = password();
@@ -560,13 +560,13 @@ IDevice::Ptr MaemoDeviceConfigWizard::device()
     sshParams.host = d->wizardData.hostName;
     sshParams.port = d->wizardData.sshPort;
     if (d->wizardData.machineType == IDevice::Emulator) {
-        sshParams.authenticationType = QSsh::SshConnectionParameters::AuthenticationByPassword;
+        sshParams.authenticationType = QSsh::SshConnectionParameters::AuthenticationTypePassword;
         sshParams.password.clear();
         sshParams.timeout = 30;
         freePortsSpec = QLatin1String("13219,14168");
         doTest = false;
     } else {
-        sshParams.authenticationType = QSsh::SshConnectionParameters::AuthenticationByKey;
+        sshParams.authenticationType = QSsh::SshConnectionParameters::AuthenticationTypePublicKey;
         sshParams.privateKeyFile = d->wizardData.privateKeyFilePath;
         sshParams.timeout = 10;
         freePortsSpec = QLatin1String("10000-10100");
diff --git a/src/plugins/madde/maemopublisherfremantlefree.cpp b/src/plugins/madde/maemopublisherfremantlefree.cpp
index d5dd05fade..34d88099ff 100644
--- a/src/plugins/madde/maemopublisherfremantlefree.cpp
+++ b/src/plugins/madde/maemopublisherfremantlefree.cpp
@@ -70,7 +70,7 @@ MaemoPublisherFremantleFree::MaemoPublisherFremantleFree(const ProjectExplorer::
     m_state(Inactive),
     m_uploader(0)
 {
-    m_sshParams.authenticationType = SshConnectionParameters::AuthenticationByKey;
+    m_sshParams.authenticationType = SshConnectionParameters::AuthenticationTypePublicKey;
     m_sshParams.timeout = 30;
     m_sshParams.port = 22;
     m_process = new QProcess(this);
diff --git a/src/plugins/projectexplorer/devicesupport/idevice.cpp b/src/plugins/projectexplorer/devicesupport/idevice.cpp
index 0d4bae0816..517a923544 100644
--- a/src/plugins/projectexplorer/devicesupport/idevice.cpp
+++ b/src/plugins/projectexplorer/devicesupport/idevice.cpp
@@ -163,7 +163,7 @@ const char PasswordKey[] = "Password";
 const char TimeoutKey[] = "Timeout";
 
 typedef QSsh::SshConnectionParameters::AuthenticationType AuthType;
-const AuthType DefaultAuthType = QSsh::SshConnectionParameters::AuthenticationByKey;
+const AuthType DefaultAuthType = QSsh::SshConnectionParameters::AuthenticationTypePublicKey;
 const IDevice::MachineType DefaultMachineType = IDevice::Hardware;
 
 const int DefaultTimeout = 10;
diff --git a/src/plugins/qnx/blackberryapplicationrunner.cpp b/src/plugins/qnx/blackberryapplicationrunner.cpp
index 1f24c5765f..7ceb5056d3 100644
--- a/src/plugins/qnx/blackberryapplicationrunner.cpp
+++ b/src/plugins/qnx/blackberryapplicationrunner.cpp
@@ -85,7 +85,7 @@ BlackBerryApplicationRunner::BlackBerryApplicationRunner(bool debugMode, BlackBe
 
     // The BlackBerry device always uses key authentication
     m_sshParams = m_device->sshParameters();
-    m_sshParams.authenticationType = QSsh::SshConnectionParameters::AuthenticationByKey;
+    m_sshParams.authenticationType = QSsh::SshConnectionParameters::AuthenticationTypePublicKey;
 
     m_runningStateTimer->setInterval(3000);
     m_runningStateTimer->setSingleShot(true);
diff --git a/src/plugins/qnx/blackberrydeviceconfigurationwizard.cpp b/src/plugins/qnx/blackberrydeviceconfigurationwizard.cpp
index 414ef2c93f..81020bdb85 100644
--- a/src/plugins/qnx/blackberrydeviceconfigurationwizard.cpp
+++ b/src/plugins/qnx/blackberrydeviceconfigurationwizard.cpp
@@ -60,7 +60,7 @@ ProjectExplorer::IDevice::Ptr BlackBerryDeviceConfigurationWizard::device()
     sshParams.options = QSsh::SshIgnoreDefaultProxy;
     sshParams.host = m_setupPage->hostName();
     sshParams.password = m_setupPage->password();
-    sshParams.authenticationType = QSsh::SshConnectionParameters::AuthenticationByKey;
+    sshParams.authenticationType = QSsh::SshConnectionParameters::AuthenticationTypePublicKey;
     sshParams.privateKeyFile = m_sshKeyPage->privateKey();
     sshParams.userName = QLatin1String("devuser");
     sshParams.timeout = 10;
diff --git a/src/plugins/qnx/blackberrysetupwizard.cpp b/src/plugins/qnx/blackberrysetupwizard.cpp
index 2a5df8bb32..0cd040b3b8 100644
--- a/src/plugins/qnx/blackberrysetupwizard.cpp
+++ b/src/plugins/qnx/blackberrysetupwizard.cpp
@@ -518,7 +518,7 @@ IDevice::Ptr BlackBerrySetupWizard::device()
     sshParams.options = QSsh::SshIgnoreDefaultProxy;
     sshParams.host = hostName();
     sshParams.password = devicePassword();
-    sshParams.authenticationType = QSsh::SshConnectionParameters::AuthenticationByKey;
+    sshParams.authenticationType = QSsh::SshConnectionParameters::AuthenticationTypePublicKey;
     sshParams.privateKeyFile = privateKeyPath();
     sshParams.userName = QLatin1String("devuser");
     sshParams.timeout = 10;
diff --git a/src/plugins/qnx/qnxdeviceconfigurationwizard.cpp b/src/plugins/qnx/qnxdeviceconfigurationwizard.cpp
index c14d69530c..d60ec64de1 100644
--- a/src/plugins/qnx/qnxdeviceconfigurationwizard.cpp
+++ b/src/plugins/qnx/qnxdeviceconfigurationwizard.cpp
@@ -66,7 +66,7 @@ IDevice::Ptr QnxDeviceConfigurationWizard::device()
     sshParams.port = 22;
     sshParams.timeout = 10;
     sshParams.authenticationType = m_setupPage->authenticationType();
-    if (sshParams.authenticationType == QSsh::SshConnectionParameters::AuthenticationByPassword)
+    if (sshParams.authenticationType == QSsh::SshConnectionParameters::AuthenticationTypePassword)
         sshParams.password = m_setupPage->password();
     else
         sshParams.privateKeyFile = m_setupPage->privateKeyFilePath();
diff --git a/src/plugins/remotelinux/genericlinuxdeviceconfigurationwidget.cpp b/src/plugins/remotelinux/genericlinuxdeviceconfigurationwidget.cpp
index 9c94f21a70..ee93658fc3 100644
--- a/src/plugins/remotelinux/genericlinuxdeviceconfigurationwidget.cpp
+++ b/src/plugins/remotelinux/genericlinuxdeviceconfigurationwidget.cpp
@@ -74,8 +74,8 @@ void GenericLinuxDeviceConfigurationWidget::authenticationTypeChanged()
     SshConnectionParameters sshParams = device()->sshParameters();
     const bool usePassword = m_ui->passwordButton->isChecked();
     sshParams.authenticationType = usePassword
-        ? SshConnectionParameters::AuthenticationByPassword
-        : SshConnectionParameters::AuthenticationByKey;
+        ? SshConnectionParameters::AuthenticationTypeTryAllPasswordBasedMethods
+        : SshConnectionParameters::AuthenticationTypePublicKey;
     device()->setSshParameters(sshParams);
     m_ui->pwdLineEdit->setEnabled(usePassword);
     m_ui->passwordLabel->setEnabled(usePassword);
@@ -183,7 +183,7 @@ void GenericLinuxDeviceConfigurationWidget::initGui()
 
     const SshConnectionParameters &sshParams = device()->sshParameters();
 
-    if (sshParams.authenticationType == SshConnectionParameters::AuthenticationByPassword)
+    if (sshParams.authenticationType != SshConnectionParameters::AuthenticationTypePublicKey)
         m_ui->passwordButton->setChecked(true);
     else
         m_ui->keyButton->setChecked(true);
diff --git a/src/plugins/remotelinux/genericlinuxdeviceconfigurationwizard.cpp b/src/plugins/remotelinux/genericlinuxdeviceconfigurationwizard.cpp
index add6ab5909..c33bef0c8e 100644
--- a/src/plugins/remotelinux/genericlinuxdeviceconfigurationwizard.cpp
+++ b/src/plugins/remotelinux/genericlinuxdeviceconfigurationwizard.cpp
@@ -83,7 +83,7 @@ IDevice::Ptr GenericLinuxDeviceConfigurationWizard::device()
     sshParams.port = 22;
     sshParams.timeout = 10;
     sshParams.authenticationType = d->setupPage.authenticationType();
-    if (sshParams.authenticationType == SshConnectionParameters::AuthenticationByPassword)
+    if (sshParams.authenticationType != SshConnectionParameters::AuthenticationTypePublicKey)
         sshParams.password = d->setupPage.password();
     else
         sshParams.privateKeyFile = d->setupPage.privateKeyFilePath();
diff --git a/src/plugins/remotelinux/genericlinuxdeviceconfigurationwizardpages.cpp b/src/plugins/remotelinux/genericlinuxdeviceconfigurationwizardpages.cpp
index d187773a19..a64c3ba05e 100644
--- a/src/plugins/remotelinux/genericlinuxdeviceconfigurationwizardpages.cpp
+++ b/src/plugins/remotelinux/genericlinuxdeviceconfigurationwizardpages.cpp
@@ -86,7 +86,7 @@ void GenericLinuxDeviceConfigurationWizardSetupPage::initializePage()
 bool GenericLinuxDeviceConfigurationWizardSetupPage::isComplete() const
 {
     return !configurationName().isEmpty() && !hostName().isEmpty() && !userName().isEmpty()
-            && (authenticationType() == SshConnectionParameters::AuthenticationByPassword
+            && (authenticationType() != SshConnectionParameters::AuthenticationTypePublicKey
                 || d->ui.privateKeyPathChooser->isValid());
 }
 
@@ -108,8 +108,8 @@ QString GenericLinuxDeviceConfigurationWizardSetupPage::userName() const
 SshConnectionParameters::AuthenticationType GenericLinuxDeviceConfigurationWizardSetupPage::authenticationType() const
 {
     return d->ui.passwordButton->isChecked()
-        ? SshConnectionParameters::AuthenticationByPassword
-        : SshConnectionParameters::AuthenticationByKey;
+        ? SshConnectionParameters::AuthenticationTypeTryAllPasswordBasedMethods
+        : SshConnectionParameters::AuthenticationTypePublicKey;
 }
 
 QString GenericLinuxDeviceConfigurationWizardSetupPage::password() const
@@ -144,8 +144,8 @@ QString GenericLinuxDeviceConfigurationWizardSetupPage::defaultPassWord() const
 
 void GenericLinuxDeviceConfigurationWizardSetupPage::handleAuthTypeChanged()
 {
-    d->ui.passwordLineEdit->setEnabled(authenticationType() == SshConnectionParameters::AuthenticationByPassword);
-    d->ui.privateKeyPathChooser->setEnabled(authenticationType() == SshConnectionParameters::AuthenticationByKey);
+    d->ui.passwordLineEdit->setEnabled(authenticationType() != SshConnectionParameters::AuthenticationTypePublicKey);
+    d->ui.privateKeyPathChooser->setEnabled(!d->ui.passwordLineEdit->isEnabled());
     emit completeChanged();
 }
 
diff --git a/tests/manual/ssh/errorhandling/main.cpp b/tests/manual/ssh/errorhandling/main.cpp
index 08a09f5a66..d3bd55d057 100644
--- a/tests/manual/ssh/errorhandling/main.cpp
+++ b/tests/manual/ssh/errorhandling/main.cpp
@@ -60,13 +60,15 @@ public:
         noHost.host = QLatin1String("hgdfxgfhgxfhxgfchxgcf");
         noHost.port = 12345;
         noHost.timeout = 10;
-        noHost.authenticationType = SshConnectionParameters::AuthenticationByPassword;
+        noHost.authenticationType
+                = SshConnectionParameters::AuthenticationTypeTryAllPasswordBasedMethods;
 
         SshConnectionParameters noUser;
         noUser.host = QLatin1String("localhost");
         noUser.port = 22;
         noUser.timeout = 30;
-        noUser.authenticationType = SshConnectionParameters::AuthenticationByPassword;
+        noUser.authenticationType
+                = SshConnectionParameters::AuthenticationTypeTryAllPasswordBasedMethods;
         noUser.userName = QLatin1String("dumdidumpuffpuff");
         noUser.password = QLatin1String("whatever");
 
@@ -74,7 +76,8 @@ public:
         wrongPwd.host = QLatin1String("localhost");
         wrongPwd.port = 22;
         wrongPwd.timeout = 30;
-        wrongPwd.authenticationType = SshConnectionParameters::AuthenticationByPassword;
+        wrongPwd.authenticationType
+                = SshConnectionParameters::AuthenticationTypeTryAllPasswordBasedMethods;
         wrongPwd.userName = QLatin1String("root");
         noUser.password = QLatin1String("thiscantpossiblybeapasswordcanit");
 
@@ -82,7 +85,7 @@ public:
         invalidKeyFile.host = QLatin1String("localhost");
         invalidKeyFile.port = 22;
         invalidKeyFile.timeout = 30;
-        invalidKeyFile.authenticationType = SshConnectionParameters::AuthenticationByKey;
+        invalidKeyFile.authenticationType = SshConnectionParameters::AuthenticationTypePublicKey;
         invalidKeyFile.userName = QLatin1String("root");
         invalidKeyFile.privateKeyFile
             = QLatin1String("somefilenamethatwedontexpecttocontainavalidkey");
diff --git a/tests/manual/ssh/remoteprocess/argumentscollector.cpp b/tests/manual/ssh/remoteprocess/argumentscollector.cpp
index 2bf9356f0d..113a60863f 100644
--- a/tests/manual/ssh/remoteprocess/argumentscollector.cpp
+++ b/tests/manual/ssh/remoteprocess/argumentscollector.cpp
@@ -65,7 +65,7 @@ QSsh::SshConnectionParameters ArgumentsCollector::collect(bool &success) const
                 if (!parameters.privateKeyFile.isEmpty())
                     throw ArgumentErrorException(QLatin1String("-pwd and -k are mutually exclusive."));
                 parameters.authenticationType
-                    = SshConnectionParameters::AuthenticationByPassword;
+                    = SshConnectionParameters::AuthenticationTypeTryAllPasswordBasedMethods;
                 authTypeGiven = true;
                 continue;
             }
@@ -73,7 +73,7 @@ QSsh::SshConnectionParameters ArgumentsCollector::collect(bool &success) const
                 if (!parameters.password.isEmpty())
                     throw ArgumentErrorException(QLatin1String("-pwd and -k are mutually exclusive."));
                 parameters.authenticationType
-                    = SshConnectionParameters::AuthenticationByKey;
+                    = SshConnectionParameters::AuthenticationTypePublicKey;
                 authTypeGiven = true;
                 continue;
             }
@@ -88,7 +88,7 @@ QSsh::SshConnectionParameters ArgumentsCollector::collect(bool &success) const
         }
 
         if (!authTypeGiven) {
-            parameters.authenticationType = SshConnectionParameters::AuthenticationByKey;
+            parameters.authenticationType = SshConnectionParameters::AuthenticationTypePublicKey;
             parameters.privateKeyFile = QDir::homePath() + QLatin1String("/.ssh/id_rsa");
         }
 
diff --git a/tests/manual/ssh/sftp/argumentscollector.cpp b/tests/manual/ssh/sftp/argumentscollector.cpp
index 5a8a765e89..adff4fe3f7 100644
--- a/tests/manual/ssh/sftp/argumentscollector.cpp
+++ b/tests/manual/ssh/sftp/argumentscollector.cpp
@@ -66,7 +66,7 @@ Parameters ArgumentsCollector::collect(bool &success) const
                 if (!parameters.sshParams.privateKeyFile.isEmpty())
                     throw ArgumentErrorException(QLatin1String("-pwd and -k are mutually exclusive."));
                 parameters.sshParams.authenticationType
-                    = SshConnectionParameters::AuthenticationByPassword;
+                    = SshConnectionParameters::AuthenticationTypeTryAllPasswordBasedMethods;
                 authTypeGiven = true;
                 continue;
             }
@@ -74,7 +74,7 @@ Parameters ArgumentsCollector::collect(bool &success) const
                 if (!parameters.sshParams.password.isEmpty())
                     throw ArgumentErrorException(QLatin1String("-pwd and -k are mutually exclusive."));
                 parameters.sshParams.authenticationType
-                    = SshConnectionParameters::AuthenticationByKey;
+                    = SshConnectionParameters::AuthenticationTypePublicKey;
                 authTypeGiven = true;
                 continue;
             }
diff --git a/tests/manual/ssh/sftpfsmodel/window.cpp b/tests/manual/ssh/sftpfsmodel/window.cpp
index 989fbde6b9..8f123ac8da 100644
--- a/tests/manual/ssh/sftpfsmodel/window.cpp
+++ b/tests/manual/ssh/sftpfsmodel/window.cpp
@@ -62,7 +62,8 @@ void SftpFsWindow::connectToHost()
     SshConnectionParameters sshParams;
     sshParams.host = m_ui->hostLineEdit->text();
     sshParams.userName = m_ui->userLineEdit->text();
-    sshParams.authenticationType = SshConnectionParameters::AuthenticationByPassword;
+    sshParams.authenticationType
+            = SshConnectionParameters::AuthenticationTypeTryAllPasswordBasedMethods;
     sshParams.password = m_ui->passwordLineEdit->text();
     sshParams.port = m_ui->portSpinBox->value();
     sshParams.timeout = 10;
diff --git a/tests/manual/ssh/tunnel/argumentscollector.cpp b/tests/manual/ssh/tunnel/argumentscollector.cpp
index b05a323a41..5841d7bd14 100644
--- a/tests/manual/ssh/tunnel/argumentscollector.cpp
+++ b/tests/manual/ssh/tunnel/argumentscollector.cpp
@@ -66,7 +66,7 @@ QSsh::SshConnectionParameters ArgumentsCollector::collect(bool &success) const
                 if (!parameters.privateKeyFile.isEmpty())
                     throw ArgumentErrorException(QLatin1String("-pwd and -k are mutually exclusive."));
                 parameters.authenticationType
-                    = SshConnectionParameters::AuthenticationByPassword;
+                    = SshConnectionParameters::AuthenticationTypeTryAllPasswordBasedMethods;
                 authTypeGiven = true;
                 continue;
             }
@@ -74,7 +74,7 @@ QSsh::SshConnectionParameters ArgumentsCollector::collect(bool &success) const
                 if (!parameters.password.isEmpty())
                     throw ArgumentErrorException(QLatin1String("-pwd and -k are mutually exclusive."));
                 parameters.authenticationType
-                    = SshConnectionParameters::AuthenticationByKey;
+                    = SshConnectionParameters::AuthenticationTypePublicKey;
                 authTypeGiven = true;
                 continue;
             }
@@ -89,7 +89,7 @@ QSsh::SshConnectionParameters ArgumentsCollector::collect(bool &success) const
         }
 
         if (!authTypeGiven) {
-            parameters.authenticationType = SshConnectionParameters::AuthenticationByKey;
+            parameters.authenticationType = SshConnectionParameters::AuthenticationTypePublicKey;
             parameters.privateKeyFile = QDir::homePath() + QLatin1String("/.ssh/id_rsa");
         }