guardian: React on BF attacks for SSH at pre-auth stage.

See #10457.

config/guardian/guardian.pl

@@ -106,6 +106,10 @@ for (;;) {
 					$temp = $array[11];
 				}
 				&checkssh ($temp, "possible SSH-Bruteforce Attack");}
+
+			# This should catch Bruteforce Attacks with enabled preauth
+			if ($_ =~ /.*sshd.*Received disconnect from (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}):.*\[preauth\]/) {
+				&checkssh ($1, "possible SSH-Bruteforce Attack, failed preauth");}
 			}
 	}
 
@@ -424,4 +428,4 @@ sub get_aliases {
 	}
 
 	print "done \n";
-}
+}