anchor.diff:                  "auth required ${pkgs.duo-unix}/lib/security/pam_duo.so"}
               '') + ''
             ${optionalString cfg.unixAuth
  -              "auth sufficient pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} likeauth try_first_pass"}
  +              "auth sufficient pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} ${optionalString cfg.nodelay "nodelay"} likeauth try_first_pass"}
             ${optionalString cfg.otpwAuth
                 "auth sufficient ${pkgs.otpw}/lib/security/pam_otpw.so"}
             ${optionalString use_ldap
  
positive.code:             || cfg.enableGnomeKeyring
              || cfg.googleAuthenticator.enable
              || cfg.duoSecurity.enable)) ''
                auth required pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} likeauth
                ${optionalString config.security.pam.enableEcryptfs
                  "auth optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so unwrap"}
                ${optionalString cfg.pamMount
  
negative.code:           field set to <literal>!</literal>).  Note that regardless of
            what the pam_unix documentation says, accounts with hashed
            empty passwords are always allowed to log in.
          '';
        };
  
        nodelay = mkOption {
          default = false;
          type = types.bool;
          description = ''
            Wheather the delay after typing a wrong password should be disabled.
          '';
        };
  
  