it seems the 1.4.0-3 removed the tally/tally2 modules and (for some reason) I had `auth required pam_tally2.so` in /etc/pam.d/system-login. Of course that broke the login and I had to rescue the installation from a bootable USB. I wonder if there can be some pam-lint tool that checks your /etc/pam.d/ after upgrades. -- damjan