def auth_password(self, username, password, event=None, fallback=True):
if (not self.active) or (not self.initial_kex_done):<EOL><INDENT>raise SSHException('<STR_LIT>')<EOL><DEDENT>if event is None:<EOL><INDENT>my_event = threading.Event()<EOL><DEDENT>else:<EOL><INDENT>my_event = event<EOL><DEDENT>self.auth_handler = AuthHandler(self)<EOL>self.auth_handler.auth_password(username, password, my_event)<EOL>if event is not None:<EOL><INDENT>return []<EOL><DEDENT>try:<EOL><INDENT>return self.auth_handler.wait_for_response(my_event)<EOL><DEDENT>except BadAuthenticationType as x:<EOL><INDENT>if not fallback or ('<STR_LIT>' not in x.allowed_types):<EOL><INDENT>raise<EOL><DEDENT>try:<EOL><INDENT>def handler(title, instructions, fields):<EOL><INDENT>if len(fields) > <NUM_LIT:1>:<EOL><INDENT>raise SSHException('<STR_LIT>')<EOL><DEDENT>if len(fields) == <NUM_LIT:0>:<EOL><INDENT>return []<EOL><DEDENT>return [ password ]<EOL><DEDENT>return self.auth_interactive(username, handler)<EOL><DEDENT>except SSHException as ignored:<EOL><INDENT>raise x<EOL><DEDENT><DEDENT>return None<EOL>
Authenticate to the server using a password.  The username and password
are sent over an encrypted link.

If an C{event} is passed in, this method will return immediately, and
the event will be triggered once authentication succeeds or fails.  On
success, L{is_authenticated} will return C{True}.  On failure, you may
use L{get_exception} to get more detailed error information.

Since 1.1, if no event is passed, this method will block until the
authentication succeeds or fails.  On failure, an exception is raised.
Otherwise, the method simply returns.

Since 1.5, if no event is passed and C{fallback} is C{True} (the
default), if the server doesn't support plain password authentication
but does support so-called "keyboard-interactive" mode, an attempt
will be made to authenticate using this interactive mode.  If it fails,
the normal exception will be thrown as if the attempt had never been
made.  This is useful for some recent Gentoo and Debian distributions,
which turn off plain password authentication in a misguided belief
that interactive authentication is "more secure".  (It's not.)

If the server requires multi-step authentication (which is very rare),
this method will return a list of auth types permissible for the next
step.  Otherwise, in the normal case, an empty list is returned.

@param username: the username to authenticate as
@type username: str
@param password: the password to authenticate with
@type password: str or unicode
@param event: an event to trigger when the authentication attempt is
    complete (whether it was successful or not)
@type event: threading.Event
@param fallback: C{True} if an attempt at an automated "interactive"
    password auth should be made if the server doesn't support normal
    password auth
@type fallback: bool
@return: list of auth types permissible for the next stage of
    authentication (normally empty)
@rtype: list

@raise BadAuthenticationType: if password authentication isn't
    allowed by the server for this user (and no event was passed in)
@raise AuthenticationException: if the authentication failed (and no
    event was passed in)
@raise SSHException: if there was a network error