I'm not sure I see a huge benefit to all the overloads, e.g. user without a password argument. To me it's clearer and much less error-prone to have one constructor and just pass null for the unused arguments (without the other overloaded constructors).

If you want to support different argument lists I might consider going with a factory that has unique static method names for each unique way of constructing an SFTPSession object.