more explicit match for sshd filter & added test