It looks like Steve had an explicit reason for disabling pam_tally here and I don't want to go second guess that. (Steve, if I'm wrong, please chime in). In particular, Steve kept pam_cracklib, which also requires an extra option, but did not keep pam_tally.
I also think there is another wrinkle here. I don't know if the pam_tally from libpam-modules 1.3.x works with the libpam0g from 1.4.x. I'll need to test that. By the time the preinst script runs for libpam-modules, the new pam libraries will already be unpacked. I'd much rather bring back pam_tally for a release cycle than add a preinst script to a pseudo-essential library like libpam0g. I realize that libpam-modules is also psuedo-essential, but it already has a preinst script. --Sam
