anchor.diff:                   " kwalletd=${pkgs.libsForQt5.kwallet.bin}/bin/kwalletd5")}
                 ${optionalString cfg.enableGnomeKeyring
                   ("auth optional ${pkgs.gnome3.gnome_keyring}/lib/security/pam_gnome_keyring.so")}
  +              ${optionalString cfg.googleAuthenticator.enable
  +                  "auth required ${pkgs.googleAuthenticator}/lib/security/pam_google_authenticator.so no_increment_hotp"}
               '') + ''
             ${optionalString cfg.unixAuth
                 "auth sufficient pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} likeauth try_first_pass"}
  
positive.code:           <filename>~/.config/Yubico/u2f_keys</filename> are able to log in
            with the associated U2F key.
          '';
        };
  
        usbAuth = mkOption {
  
negative.code:           # prompts the user for password so we run it once with 'required' at an
            # earlier point and it will run again with 'sufficient' further down.
            # We use try_first_pass the second time to avoid prompting password twice
            (optionalString (cfg.unixAuth &&
            (config.security.pam.enableEcryptfs
              || cfg.pamMount
              || cfg.enableKwallet
              || cfg.enableGnomeKeyring
              || cfg.googleAuthenticator.enable)) ''
                auth required pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} likeauth
                ${optionalString config.security.pam.enableEcryptfs
                  "auth optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so unwrap"}
  