sshguard no longer adds rule to INPUT chain (regression on upgrade)

An Ubuntu 18.04 system with sshguard installed blocks ssh attacks by default, with no additional configuration required. After upgrading to Ubuntu 20.04, attacks no longer get blocked without further action by the user.

sshguard 1.7.1-1 on Ubuntu 18.04 used to add a rule to the iptables INPUT chain on startup (c/o "/usr/lib/sshguard/firewall enable") and remove it on shutdown.

sshguard 2.3.1-1ubuntu1.1 on Ubuntu 20.04 no longer does this. The role of /usr/lib/sshguard/firewall is now handled by ExecStartPre= lines in sshguard.service, and by the fw_init function in /usr/lib/x86_64-linux-gnu/sshg-fw-iptables. All this does is create an empty "sshguard" chain. No reference to this chain is added to the INPUT chain.

sshguard adds rules to this chain to drop packets from offending IP addresses, but nothing actually gets blocked as there is no rule directing any traffic at this chain.

For sshguard to function in 20.04 the user must themselves arrange for the relevant rule to be added to INPUT (e.g. "iptables -I INPUT -j sshguard" on boot). This change is not noted in the changelog, nor in any included documentation.