From 0e8bd9ee0b6c7758ebc537192b5c0306e4dd7699 Mon Sep 17 00:00:00 2001
From: Alex 'AdUser' Z <ad_user@runbox.com>
Date: Fri, 9 Sep 2016 18:08:47 +1000
Subject: [PATCH] * fix ssh filter

---
 filters/ssh.preg | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/filters/ssh.preg b/filters/ssh.preg
index d1c63a1..940dafb 100644
--- a/filters/ssh.preg
+++ b/filters/ssh.preg
@@ -5,7 +5,7 @@ refused connect from [[:print:]]+ \(<HOST>\)
 Received disconnect from <HOST>: [0-9]*: [[:print:]]+: Auth fail
 Did not receive identification string from <HOST>
 Invalid user [[:print:]]+ from <HOST>
-Connection closed by <HOST> \[preauth\]
+Connection closed by <HOST>( port [0-9]+)? \[preauth\]
 Postponed keyboard-interactive for invalid user [[:print:]]+ from <HOST> port [0-9]+
 User [[:print:]]+ from <HOST> not allowed because not listed in AllowUsers
 User [[:print:]]+ from <HOST> not allowed because listed in DenyUsers