anchor.diff:                "session optional ${pam_ldap}/lib/security/pam_ldap.so"}
             ${optionalString config.krb5.enable
                 "session optional ${pam_krb5}/lib/security/pam_krb5.so"}
  +          ${optionalString otpwAuth
  +              "session optional ${pkgs.otpw}/lib/security/pam_otpw.so"}
             ${optionalString startSession
                 "session optional ${pkgs.systemd}/lib/security/pam_systemd.so"}
             ${optionalString forwardXAuth
  
positive.code:         '';
      };
  
      users.motd = mkOption {
        default = null;
        example = "Today is Sweetmorn, the 4th day of The Aftermath in the YOLD 3178.";
  
negative.code:     , # If set, user listed in /etc/pamusb.conf are able to log in with
        # the associated usb key.
        usbAuth ? config.security.pam.usb.enable
      , # If set, OTPW system will be used (if ~/.otpw exists)
        otpwAuth ? config.security.pam.enableOTPW
      , # If set, the calling user's SSH agent is used to authenticate
        # against the keys in the calling user's ~/.ssh/authorized_keys.
        # This is useful for "sudo" on password-less remote systems.
  