anchor.diff:            <filename>$HOME/.config/Yubico/u2f_keys</filename> if XDG variable is
             not set) are able to log in with the associated U2F key. Path can be
             changed using <option>security.pam.u2f.authFile</option> option.
  +        '';
  +      };
  +
  +      yubicoAuth = mkOption {
  +        default = config.security.pam.yubico.enable;
  +        type = types.bool;
  +        description = ''
  +          If set, users listed in
  +          <filename>~/.yubico/authorized_yubikeys</filename>
  +          are able to log in with the asociated Yubikey tokens.
           '';
         };
   
  
positive.code:               "auth sufficient ${pkgs.pam_usb}/lib/security/pam_usb.so"}
            ${let oath = config.security.pam.oath; in optionalString cfg.oathAuth
                "auth requisite ${pkgs.oathToolkit}/lib/security/pam_oath.so window=${toString oath.window} usersfile=${toString oath.usersFile} digits=${toString oath.digits}"}
          '' +
            # Modules in this block require having the password set in PAM_AUTHTOK.
            # pam_unix is marked as 'sufficient' on NixOS which means nothing will run
  
negative.code:       };
      };
  
      security.pam.yubico = {
        enable = mkOption {
          default = false;
          type = types.bool;
          description = ''
            Enables Yubico PAM (<literal>yubico-pam</literal>) module.
  
            If set, users listed in
            <filename>~/.yubico/authorized_yubikeys</filename>
            are able to log in with the associated Yubikey tokens.
  
            The file must have only one line:
            <literal>username:yubikey_token_id1:yubikey_token_id2</literal>
            More information can be found <link
            xlink:href="https://developers.yubico.com/yubico-pam/">here</link>.
          '';
        };
        control = mkOption {
          default = "sufficient";
          type = types.enum [ "required" "requisite" "sufficient" "optional" ];
          description = ''
            This option sets pam "control".
            If you want to have multi factor authentication, use "required".
            If you want to use Yubikey instead of regular password, use "sufficient".
  
            Read
            <citerefentry>
              <refentrytitle>pam.conf</refentrytitle>
              <manvolnum>5</manvolnum>
            </citerefentry>
            for better understanding of this option.
          '';
        };
        id = mkOption {
          example = "42";
          type = types.string;
          description = "client id";
        };
  
        debug = mkOption {
          default = false;
          type = types.bool;
          description = ''
            Debug output to stderr.
          '';
        };
      };
  
      security.pam.enableEcryptfs = mkOption {
        default = false;
        description = ''
  