Hi,

a default install of sshguard runs as root by default, which has certain
security implications we should avoid. Most action don't require root:

logreading:
Reading relevant files in /var/log/ or running journalctl requires only an
unprivileged user in the adm group.

logparsing:
requires no permissions at all.

sshg-blocker:
requires no permissions at all.

calling the firewall backend:
iptables/nftables will require root, but firewalld can for example be called via
dbus.

Consider selectively dropping privs along the pipeline and packaging it as such
by default.

Greets,
Lee