One hour later, it appears that sshguard is working fine. It's structured as a dozen binaries or so, but it has no dependencies. I haven't done any CPU usage measurements, but I haven't seen it appear in top's output.