def _auth(self, username, password, pkey, key_filenames, allow_agent, look_for_keys):
saved_exception = None<EOL>two_factor = False<EOL>allowed_types = []<EOL>if pkey is not None:<EOL><INDENT>try:<EOL><INDENT>self._log(DEBUG, '<STR_LIT>' % hexlify(pkey.get_fingerprint()))<EOL>allowed_types = self._transport.auth_publickey(username, pkey)<EOL>two_factor = (allowed_types == ['<STR_LIT:password>'])<EOL>if not two_factor:<EOL><INDENT>return<EOL><DEDENT><DEDENT>except SSHException as e:<EOL><INDENT>saved_exception = e<EOL><DEDENT><DEDENT>if not two_factor:<EOL><INDENT>for key_filename in key_filenames:<EOL><INDENT>for pkey_class in (RSAKey, DSSKey):<EOL><INDENT>try:<EOL><INDENT>key = pkey_class.from_private_key_file(key_filename, password)<EOL>self._log(DEBUG, '<STR_LIT>' % (hexlify(key.get_fingerprint()), key_filename))<EOL>self._transport.auth_publickey(username, key)<EOL>two_factor = (allowed_types == ['<STR_LIT:password>'])<EOL>if not two_factor:<EOL><INDENT>return<EOL><DEDENT>break<EOL><DEDENT>except SSHException as e:<EOL><INDENT>saved_exception = e<EOL><DEDENT><DEDENT><DEDENT><DEDENT>if not two_factor and allow_agent:<EOL><INDENT>if self._agent == None:<EOL><INDENT>self._agent = Agent()<EOL><DEDENT>for key in self._agent.get_keys():<EOL><INDENT>try:<EOL><INDENT>self._log(DEBUG, '<STR_LIT>' % hexlify(key.get_fingerprint()))<EOL>allowed_types = self._transport.auth_publickey(username, key)<EOL>two_factor = (allowed_types == ['<STR_LIT:password>'])<EOL>if not two_factor:<EOL><INDENT>return<EOL><DEDENT>break<EOL><DEDENT>except SSHException as e:<EOL><INDENT>saved_exception = e<EOL><DEDENT><DEDENT><DEDENT>if not two_factor:<EOL><INDENT>keyfiles = []<EOL>rsa_key = os.path.expanduser('<STR_LIT>')<EOL>dsa_key = os.path.expanduser('<STR_LIT>')<EOL>if os.path.isfile(rsa_key):<EOL><INDENT>keyfiles.append((RSAKey, rsa_key))<EOL><DEDENT>if os.path.isfile(dsa_key):<EOL><INDENT>keyfiles.append((DSSKey, dsa_key))<EOL><DEDENT>rsa_key = os.path.expanduser('<STR_LIT>')<EOL>dsa_key = os.path.expanduser('<STR_LIT>')<EOL>if os.path.isfile(rsa_key):<EOL><INDENT>keyfiles.append((RSAKey, rsa_key))<EOL><DEDENT>if os.path.isfile(dsa_key):<EOL><INDENT>keyfiles.append((DSSKey, dsa_key))<EOL><DEDENT>if not look_for_keys:<EOL><INDENT>keyfiles = []<EOL><DEDENT>for pkey_class, filename in keyfiles:<EOL><INDENT>try:<EOL><INDENT>key = pkey_class.from_private_key_file(filename, password)<EOL>self._log(DEBUG, '<STR_LIT>' % (hexlify(key.get_fingerprint()), filename))<EOL>allowed_types = self._transport.auth_publickey(username, key)<EOL>two_factor = (allowed_types == ['<STR_LIT:password>'])<EOL>if not two_factor:<EOL><INDENT>return<EOL><DEDENT>break<EOL><DEDENT>except SSHException as e:<EOL><INDENT>saved_exception = e<EOL><DEDENT>except IOError as e:<EOL><INDENT>saved_exception = e<EOL><DEDENT><DEDENT><DEDENT>if password is not None:<EOL><INDENT>try:<EOL><INDENT>self._transport.auth_password(username, password)<EOL>return<EOL><DEDENT>except SSHException as e:<EOL><INDENT>saved_exception = e<EOL><DEDENT><DEDENT>elif two_factor:<EOL><INDENT>raise SSHException('<STR_LIT>')<EOL><DEDENT>if saved_exception is not None:<EOL><INDENT>raise saved_exception<EOL><DEDENT>raise SSHException('<STR_LIT>')<EOL>
Try, in order:

    - The key passed in, if one was passed in.
    - Any key we can find through an SSH agent (if allowed).
    - Any "id_rsa" or "id_dsa" key discoverable in ~/.ssh/ (if allowed).
    - Plain username/password auth, if a password was given.

(The password might be needed to unlock a private key.)

The password is required for two-factor authentication.