anchor.diff:          description = ''
             If set, fingerprint reader will be used (if exists and
             your fingerprints are enrolled).
  +        '';
  +      };
  +
  +      oathAuth = mkOption {
  +        default = config.security.pam.enableOATH;
  +        type = types.bool;
  +        description = ''
  +          If set, the OATH Toolkit will be used.
           '';
         };
   
  
positive.code:               "auth sufficient pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} likeauth"}
            ${optionalString cfg.otpwAuth
                "auth sufficient ${pkgs.otpw}/lib/security/pam_otpw.so"}
            ${optionalString config.users.ldap.enable
                "auth sufficient ${pam_ldap}/lib/security/pam_ldap.so use_first_pass"}
            ${optionalString config.krb5.enable ''
  
negative.code:       '';
      };
  
      security.pam.enableOATH = mkOption {
        default = false;
        description = ''
          Enable the OATH (one-time password) PAM module.
        '';
      };
  
      users.motd = mkOption {
        default = null;
        example = "Today is Sweetmorn, the 4th day of The Aftermath in the YOLD 3178.";
  