fix rule testing
it turns out the [preauth] postfix is optional in openssh so not always present. This should account for that.