anchor.diff:            # Account management.
             ${optionalString config.users.ldap.enable
                 "account optional ${pam_ldap}/lib/security/pam_ldap.so"}
  -          account required ${pam_unix2}/lib/security/pam_unix2.so
  +          account required pam_unix.so
   
             # Authentication management.
             ${optionalString rootOK
  
positive.code:   
      environment.systemPackages =
        # Include the PAM modules in the system path mostly for the manpages.
        [ pkgs.pam pam_unix2 ]
        ++ optional config.users.ldap.enable pam_ldap;
  
      environment.etc =
  
negative.code:       # set (i.e., have an empty password field in /etc/passwd or
        # /etc/group).  This does not enable logging into disabled
        # accounts (i.e., that have the password field set to `!').
        # Note that regardless of what the pam_unix documentation says,
        # accounts with hashed empty passwords are always allowed to log
        # in.
        allowNullPassword ? false
  