Package: pam Version: 1.4.0-1 pam 1.4.0-1 changlog includes this entry:
* Drop pam_tally and pam_tally2 modules, which have been deprecated upstream in favor of pam_faillock. Closes: #569746, LP: #772121. and correspondingly, the pam_tally and pam_tally2 tools have disappeared from /sbin. They were previously in the libpam-modules-bin binary package. faillock has a similar tool to query the database, which is present on Fedora, but hasn't been included on Debian. I guess that was an error of omission. This tool is also mentioned in the manpage of the pam module, so it seems we really ought to include it as well.