fix to sshd rules
I don't know where the [preauth] comes from but I don't see it in my log messages and at least for the corrupted MAC messages I had to remove it so rule 1002 does not kick in.
fix rule testing
it turns out the [preauth] postfix is optional in openssh so not always present. This should account for that.
Merge pull request #450 from ChristianBeer/sshd-fix

fix to sshd rules