Confirm the typed password, and read the auth outcome from the log

Melissa's session log settles the earlier theory: WinSCP negotiated,
sent the password, and srtSSHServer answered "Password authentication
failed". The password was typed into this script rather than read from a
string literal, so PowerShell interpolation was never involved and the
credential is simply not being accepted.

Two changes follow from that. The password is now entered twice and
compared - nothing echoes while typing, so a slipped paste and a good
one look identical, and a test on the wrong string proves nothing.

And the failure report now reads the log rather than dumping matching
lines: it separates "the server rejected the password we sent" from "the
server never offered password auth" from "it failed before any password
was sent", because those three have completely different fixes.

Test-Login.ps1

@@ -114,6 +114,24 @@ $bstr = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($secure)
 $password = [Runtime.InteropServices.Marshal]::PtrToStringAuto($bstr)
 [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($bstr)
 
+# Nothing echoes while typing, so a slipped paste looks identical to a good
+# one. Typing it twice is the only way to be sure of what actually went in.
+Write-Host "Type it once more to check: " -NoNewline -ForegroundColor White
+$secure2 = Read-Host -AsSecureString
+$bstr2 = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($secure2)
+$password2 = [Runtime.InteropServices.Marshal]::PtrToStringAuto($bstr2)
+[Runtime.InteropServices.Marshal]::ZeroFreeBSTR($bstr2)
+
+if ($password -ne $password2) {
+    Write-Host ""
+    Write-Host "  !! The two did not match." -ForegroundColor Red
+    Write-Host "     First entry: $($password.Length) characters. Second: $($password2.Length)." -ForegroundColor Red
+    Write-Host "     One of them is wrong, so this test would prove nothing." -ForegroundColor Red
+    Write-Host "     Start over and paste carefully, or type it by hand." -ForegroundColor Yellow
+    Write-Host ""
+    exit 1
+}
+
 # -- What the credentials actually contain ------------------------------------
 Write-Host ""
 Write-Host ("-" * 64)
@@ -230,18 +248,47 @@ if (-not $connected -and (Test-Path $logFile)) {
     Write-Host ("-" * 64)
     Write-Host "What the server actually said" -ForegroundColor Cyan
     Write-Host ("-" * 64)
-    $interesting = Select-String -Path $logFile -Pattern "authentic|password|keyboard|publickey|banner|denied|method" -AllMatches
+
-    if ($interesting) {
+    $log = Get-Content $logFile -ErrorAction SilentlyContinue
-        foreach ($line in ($interesting | Select-Object -First 30)) {
+
-            Write-Host "  $($line.Line.Trim())" -ForegroundColor Gray
+    $server = $log | Select-String -Pattern "Remote version:" | Select-Object -First 1
+    if ($server) { Write-Host "  $(($server.Line -split 'Remote version:')[1].Trim())" -ForegroundColor Gray }
+
+    $methodLine = $log | Select-String -Pattern "Server offered these authentication methods:" | Select-Object -First 1
+    $methods = ""
+    if ($methodLine) {
+        $methods = (($methodLine.Line -split "authentication methods:")[1]).Trim()
+        Write-Host "  Methods the server accepts: $methods" -ForegroundColor Gray
     }
+
+    $sentPassword = ($log | Select-String -Pattern "Sent password").Count -gt 0
+    $pwRejected   = ($log | Select-String -Pattern "Password authentication failed").Count -gt 0
+
     Write-Host ""
-        Write-Host "  Look for the line listing which methods the server offers." -ForegroundColor Yellow
+    if ($pwRejected -or ($sentPassword -and -not $connected)) {
-        Write-Host "  If it offers only 'publickey', a password will never work and" -ForegroundColor Yellow
+        Write-Host "  The password reached the server and the server rejected it." -ForegroundColor Yellow
-        Write-Host "  the partner has to either enable password auth or issue a key." -ForegroundColor Yellow
+        Write-Host ""
+        Write-Host "  That rules out the script, the protocol, the port and the host" -ForegroundColor Yellow
+        Write-Host "  key - all of those worked. Only three things are left:" -ForegroundColor Yellow
+        Write-Host ""
+        Write-Host "    1. The password is not the one this account expects." -ForegroundColor White
+        Write-Host "       Check it is this practice's own password, not another's." -ForegroundColor Gray
+        Write-Host "    2. The account is locked out from repeated failed tries," -ForegroundColor White
+        Write-Host "       or expired. Log in with the WinSCP window right now - if" -ForegroundColor Gray
+        Write-Host "       that fails too, it is the account, not anything here." -ForegroundColor Gray
+        Write-Host "    3. The account is set to require a key rather than a" -ForegroundColor White
+        Write-Host "       password, even though the server allows passwords" -ForegroundColor Gray
+        Write-Host "       generally. Only the partner can tell you that." -ForegroundColor Gray
+    } elseif ($methods -and $methods -notmatch "password") {
+        Write-Host "  The server never offered password authentication." -ForegroundColor Yellow
+        Write-Host "  It accepts: $methods" -ForegroundColor Yellow
+        Write-Host "  A password will never work here - the partner has to enable" -ForegroundColor Yellow
+        Write-Host "  password auth or issue an SSH key for this account." -ForegroundColor Yellow
     } else {
-        Write-Host "  (nothing recognisable - see the full log)" -ForegroundColor Gray
+        Write-Host "  It failed before any password was sent - so this is about" -ForegroundColor Yellow
+        Write-Host "  reaching the server, not about the credentials." -ForegroundColor Yellow
     }
+
     Write-Host ""
     Write-Host "  Full log: $logFile" -ForegroundColor Cyan
     Write-Host "  It contains no password. Send it to Brad." -ForegroundColor Cyan