anchor.diff:        # set (i.e., have an empty password field in /etc/passwd or
         # /etc/group).  This does not enable logging into disabled
         # accounts (i.e., that have the password field set to `!').
  -      # Note that regardless of what the pam_unix2 documentation says,
  +      # Note that regardless of what the pam_unix documentation says,
         # accounts with hashed empty passwords are always allowed to log
         # in.
         allowNullPassword ? false
  
positive.code:   
      environment.systemPackages =
        # Include the PAM modules in the system path mostly for the manpages.
        [ pkgs.pam pam_unix2 ]
        ++ optional config.users.ldap.enable pam_ldap;
  
      environment.etc =
  
negative.code:           # Account management.
            ${optionalString config.users.ldap.enable
                "account optional ${pam_ldap}/lib/security/pam_ldap.so"}
            account required pam_unix.so
  
            # Authentication management.
            ${optionalString rootOK
  