Steps

Before you begin:
The context of the following steps is for the scenario where the "client" is the z/OS system and creating an outbound connection to an ssh daemon.  
/u/user1 is the local z/OS user's home directory, who is running the OpenSSH client (ssh/sftp/scp)
remoteuser is the user id logging into the remote system
mypassword is the password for remoteuser on the remote system
remotehost is the IP address or name of the remote system.

1) The password must be retrievable using a shell script.  There are multiple options to accomplish this, but the requirement is that the shell script must be executable and return ONLY the password. 

Option 1:  Include the password in the script

Define your script to contain:

#!/bin/sh
echo mypassword

Option 2:  Place the password in a RACF protected data set

Define your script to contain:

#!/bin/sh
cat "//'HLQ.PASSWD.DSN'"

The data set in this example contains just the password.  E.g.:

Notes: 
Ensure that there is no line numbering inserted in column 80.
The data set name is arbitrary and can be altered to suit your needs. 

To evaluate the success of this step, you can run the script from the terminal and the output should be the expected password.  Example:

$ ./askpass.sh
mypassword

2) If not already present, update your JCL to include an STDENV DD statement.  Once defined, the STDENV DD statement should include the following environment (case-sensitive) variables: DISPLAY and SSH_ASKPASS

DISPLAY can contain any arbitrary value
SSH_ASKPASS contains the full pathname to the script created in step 1

Example:
//STDENV   DD  *   
DISPLAY=FOO 
SSH_ASKPASS=/u/user1/askpass.sh       
/*                                            

3) This step is written for the sftp client, see "Additional Information" for ssh and scp examples.
In your JCL where the sftp utility is invoked, "BatchMode" must be disabled for ssh/sftp to allow passwords.  (When invoking sftp in batch, password authentication is disabled by default).  To do this, the invocation flag "-oBatchMode=no" must be included, prior to the -b option.  

Here is an example combining the above two steps:

//SFTP     EXEC PGM=BPXBATCH,PARMDD=PARMINDD
//STDIN    DD DUMMY                         
//STDOUT   DD SYSOUT=*                      
//STDERR   DD SYSOUT=*                      
//STDENV   DD *                             
DISPLAY=FOO                                 
SSH_ASKPASS=/u/user1/askpass.sh     
/*                                          
//PARMINDD DD *                             
PGM                                         
 /bin/sftp -oBatchmode=no  
 -b /u/user1/sftp.commands remoteuser@remotehost             
/*                                          

Recall the -b option points to a file containing the commands to be invoked in the sftp session.