anchor.diff:  
           daemonType = "fork";
   
  -        exec = "${pkgs.openssh}/sbin/sshd -h /etc/ssh/ssh_host_dsa_key -f ${sshdConfig}";
  +        exec = 
  +          ''
  +            ${pkgs.openssh}/sbin/sshd -h /etc/ssh/ssh_host_dsa_key \
  +              -f ${pkgs.writeText "sshd_config" cfg.extraConfig}
  +          '';
         };
   
       networking.firewall.allowedTCPPorts = cfg.ports;
  +
  +    services.openssh.extraConfig =
  +      ''
  +        Protocol 2
  +
  +        UsePAM yes
  +
  +        ${concatMapStrings (port: ''
  +          Port ${toString port}
  +        '') cfg.ports}
  +
  +        ${if cfg.forwardX11 then ''
  +          X11Forwarding yes
  +          XAuthLocation ${pkgs.xlibs.xauth}/bin/xauth
  +        '' else ''
  +          X11Forwarding no
  +        ''}
  +
  +        ${optionalString cfg.allowSFTP ''
  +          Subsystem sftp ${pkgs.openssh}/libexec/sftp-server
  +        ''}
  +
  +        PermitRootLogin ${cfg.permitRootLogin}
  +        GatewayPorts ${cfg.gatewayPorts}
  +      '';
  +
     };
   
   }
  
positive.code:         '';
        };
        
      };
  
    };
  
negative.code:   cfg = config.services.openssh;
  
    nssModulesPath = config.system.nssModules.path;
  
    permitRootLoginCheck = v:
      v == "yes" ||
  