I've been get several emails about a Rule 1002 and it has to do with, sshd[31615]: fatal: no matching cipher found: client aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc,none server aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com [preauth]
That's a common error triggered by SSH scanning bots and the like when you've configured sshd to only use modern ciphers, because they tend to use really ancient versions of libssh, or whatever SSH client is available on the compromised system they're running from. You can safely ignore those messages.
