diff --git a/src/common-ssh/guac_sftp.h b/src/common-ssh/guac_sftp.h
index 13511115..6fa9f1f6 100644
--- a/src/common-ssh/guac_sftp.h
+++ b/src/common-ssh/guac_sftp.h
@@ -94,7 +94,8 @@ typedef struct guac_common_ssh_sftp_ls_state {
  * guac_common_ssh_destroy_sftp_filesystem().
  *
  * @param session
- *     The session to use to provide SFTP.
+ *     The session to use to provide SFTP. This session will automatically be
+ *     destroyed when this filesystem is destroyed.
  *
  * @param name
  *     The name to send as the name of the filesystem.
diff --git a/src/common-ssh/guac_ssh.c b/src/common-ssh/guac_ssh.c
index 9aa308d9..b9547034 100644
--- a/src/common-ssh/guac_ssh.c
+++ b/src/common-ssh/guac_ssh.c
@@ -22,6 +22,7 @@
 
 #include "guac_ssh.h"
 #include "guac_ssh_key.h"
+#include "guac_ssh_user.h"
 
 #include <guacamole/client.h>
 #include <libssh2.h>
@@ -477,8 +478,17 @@ guac_common_ssh_session* guac_common_ssh_create_session(guac_client* client,
 }
 
 void guac_common_ssh_destroy_session(guac_common_ssh_session* session) {
+
+    /* Disconnect and clean up libssh2 */
     libssh2_session_disconnect(session->session, "Bye");
     libssh2_session_free(session->session);
+
+    /* Destroy associated user */
+    if (session->user)
+        guac_common_ssh_destroy_user(session->user);
+
+    /* Free all other data */
     free(session);
+
 }
 
diff --git a/src/common-ssh/guac_ssh.h b/src/common-ssh/guac_ssh.h
index cf9e535e..64c69134 100644
--- a/src/common-ssh/guac_ssh.h
+++ b/src/common-ssh/guac_ssh.h
@@ -91,7 +91,8 @@ void guac_common_ssh_uninit();
  *     The port to connect to on the given hostname.
  *
  * @param user
- *     The user to authenticate as, once connected.
+ *     The user to authenticate as, once connected. This user will be
+ *     automatically destroyed when this session is destroyed.
  *
  * @return
  *     A new SSH session if the connection and authentication succeed, or NULL
diff --git a/src/protocols/rdp/client.c b/src/protocols/rdp/client.c
index 03cef18a..8e2945c5 100644
--- a/src/protocols/rdp/client.c
+++ b/src/protocols/rdp/client.c
@@ -828,7 +828,7 @@ int guac_client_init(guac_client* client, int argc, char** argv) {
 
         /* Parse username - use RDP username by default */
         const char* sftp_username = argv[IDX_SFTP_USERNAME];
-        if (sftp_username[0] == '\0')
+        if (sftp_username[0] == '\0' && settings->username != NULL)
             sftp_username = settings->username;
 
         guac_common_ssh_user* user = guac_common_ssh_create_user(sftp_username);
@@ -842,8 +842,10 @@ int guac_client_init(guac_client* client, int argc, char** argv) {
             /* Abort if private key cannot be read */
             if (guac_common_ssh_user_import_key(user,
                         argv[IDX_SFTP_PRIVATE_KEY],
-                        argv[IDX_SFTP_PASSPHRASE]))
+                        argv[IDX_SFTP_PASSPHRASE])) {
+                guac_common_ssh_destroy_user(user);
                 return 1;
+            }
 
         }
 
@@ -855,7 +857,7 @@ int guac_client_init(guac_client* client, int argc, char** argv) {
 
             /* Parse password - use RDP password by default */
             const char* sftp_password = argv[IDX_SFTP_USERNAME];
-            if (sftp_password[0] == '\0')
+            if (sftp_password[0] == '\0' && settings->password != NULL)
                 sftp_password = settings->password;
 
             guac_common_ssh_user_set_password(user, sftp_password);
@@ -880,6 +882,7 @@ int guac_client_init(guac_client* client, int argc, char** argv) {
         /* Fail if SSH connection does not succeed */
         if (session == NULL) {
             /* Already aborted within guac_common_ssh_create_session() */
+            guac_common_ssh_destroy_user(user);
             return 1;
         }
 
diff --git a/src/protocols/vnc/client.c b/src/protocols/vnc/client.c
index 49c53569..426b6ced 100644
--- a/src/protocols/vnc/client.c
+++ b/src/protocols/vnc/client.c
@@ -384,8 +384,10 @@ int guac_client_init(guac_client* client, int argc, char** argv) {
             /* Abort if private key cannot be read */
             if (guac_common_ssh_user_import_key(user,
                         argv[IDX_SFTP_PRIVATE_KEY],
-                        argv[IDX_SFTP_PASSPHRASE]))
+                        argv[IDX_SFTP_PASSPHRASE])) {
+                guac_common_ssh_destroy_user(user);
                 return 1;
+            }
 
         }
 
@@ -414,6 +416,7 @@ int guac_client_init(guac_client* client, int argc, char** argv) {
         /* Fail if SSH connection does not succeed */
         if (session == NULL) {
             /* Already aborted within guac_common_ssh_create_session() */
+            guac_common_ssh_destroy_user(user);
             return 1;
         }