anchor.diff:          PermitRootLogin ${cfg.permitRootLogin}
           GatewayPorts ${cfg.gatewayPorts}
           PasswordAuthentication ${if cfg.passwordAuthentication then "yes" else "no"}
  -        ChallengeResponseAuthentication ${if cfg.challengeResponseAuthentication then "yes" else "no"}
  +        KbdInteractiveAuthentication ${if cfg.kbdInteractiveAuthentication then "yes" else "no"}
   
           PrintMotd no # handled by pam_motd
   
  
positive.code:         '';
        };
  
        challengeResponseAuthentication = mkOption {
          type = types.bool;
          default = true;
          description = ''
            Specifies whether challenge/response authentication is allowed.
          '';
        };
  
  
negative.code:   imports = [
      (mkAliasOptionModule [ "services" "sshd" "enable" ] [ "services" "openssh" "enable" ])
      (mkAliasOptionModule [ "services" "openssh" "knownHosts" ] [ "programs" "ssh" "knownHosts" ])
      (mkRenamedOptionModule [ "services" "openssh" "challengeResponseAuthentication" ] [ "services" "openssh" "kbdInteractiveAuthentication" ])
    ];
  
    ###### interface
  