anchor.diff:        # set (i.e., have an empty password field in /etc/passwd or
         # /etc/group).  This does not enable logging into disabled
         # accounts (i.e., that have the password field set to `!').
  -      # Note that regardless of what the pam_unix2 documentation says,
  +      # Note that regardless of what the pam_unix documentation says,
         # accounts with hashed empty passwords are always allowed to log
         # in.
         allowNullPassword ? false
  
positive.code:               "auth sufficient ${pam_usb}/lib/security/pam_usb.so"}
            ${optionalString config.users.ldap.enable
                "auth sufficient ${pam_ldap}/lib/security/pam_ldap.so"}
            auth sufficient ${pam_unix2}/lib/security/pam_unix2.so ${
              optionalString allowNullPassword "nullok"}
            auth required   pam_deny.so
  
            # Password management.
            ${optionalString config.users.ldap.enable
                "password sufficient ${pam_ldap}/lib/security/pam_ldap.so"}
            password requisite ${pam_unix2}/lib/security/pam_unix2.so nullok
            ${optionalString config.services.samba.syncPasswordsByPam
                "password optional ${pkgs.samba}/lib/security/pam_smbpass.so nullok use_authtok try_first_pass"}
  
            # Session management.
            ${optionalString config.users.ldap.enable
                "session optional ${pam_ldap}/lib/security/pam_ldap.so"}
            session required ${pam_unix2}/lib/security/pam_unix2.so
            ${optionalString ownDevices
                "session optional ${pkgs.consolekit}/lib/security/pam_ck_connector.so"}
            ${optionalString forwardXAuth
  
negative.code:   
      environment.systemPackages =
        # Include the PAM modules in the system path mostly for the manpages.
        [ pkgs.pam ]
        ++ optional config.users.ldap.enable pam_ldap;
  
      environment.etc =
  