anchor.diff:          PrintMotd no # handled by pam_motd
   
           AuthorizedKeysFile ${toString cfg.authorizedKeysFiles}
  +
  +        ${flip concatMapStrings cfg.hostKeys (k: ''
  +          HostKey ${k.path}
  +        '')}
         '';
   
       assertions = [{ assertion = if cfg.forwardX11 then cfgc.setXAuthLocation else true;
  
positive.code:           ''
              mkdir -m 0755 -p /etc/ssh
  
              if ! test -f ${cfg.hostKeyPath}; then
                  ssh-keygen -t ${hktn} -b ${toString hktb} -f ${cfg.hostKeyPath} -N ""
              fi
  
              result=$(ssh-keygen -lf ${cfg.hostKeyPath}|awk '{ print ($1>=${toString hktsb}?1:0)}')
              if [ "$result" -ne "1" ]; then
                ERROR="SECURITY ALERT: SSH Host Key is too weak. Generate a strong key NOW."
                echo "$ERROR"
                echo "$ERROR" > /dev/console
              fi
            '';
  
          serviceConfig =
            { ExecStart =
                "${pkgs.openssh}/sbin/sshd -h ${cfg.hostKeyPath} " +
                "-f ${pkgs.writeText "sshd_config" cfg.extraConfig}";
              Restart = "always";
              Type = "forking";
  
negative.code:         '';
        };
  
        hostKeys = mkOption {
          default =
            [ { path = "/etc/ssh/ssh_host_dsa_key";
                type = "dsa";
                bits = 1024;
              }
              { path = "/etc/ssh/ssh_host_ecdsa_key";
                type = "ecdsa";
                bits = 521;
              }
            ];
          description = ''
            NixOS can automatically generate SSH host keys.  This option
            specifies the path, type and size of each key.  See
            <citerefentry><refentrytitle>ssh-keygen</refentrytitle>
            <manvolnum>1</manvolnum></citerefentry> for supported types
            and sizes.
          '';
        };
  
  