SSH_INVALID_USER
case SSH_INVALID_USER:
{SSH_INVALID_USER, "INVALID_USER"},
audit_event(ssh, SSH_INVALID_USER);
mm_audit_event(ssh, SSH_INVALID_USER);