stupid Debian lawyers...
netatalk is not linked to OpenSSL in Debian by default, because of some licensing snit. I don’t like this, because it forces cleartext passwords (and that’s hardly secure). The solution:
apt-get source netatalk sudo apt-get build-dep netatalk sudo apt-get install cracklib2-dev libssl-dev cd netatalk-2.0.3 DEB_BUILD_OPTIONS=ssl debuild sudo dpkg -i ../netatalk-*.deb