anchor.diff:          { name = "useradd"; rootOK = true; }
           # Used by groupadd etc.
           { name = "shadow"; rootOK = true; }
  -        { name = "login"; ownDevices = true; allowNullPassword = true; }
  +        { name = "login"; ownDevices = true; allowNullPassword = true;
  +          limits = config.security.pam.loginLimits;
  +        }
         ];
   
     };
  
positive.code:       session  required pam_warn.so
        session  required pam_deny.so
      '';
  
    makePAMService =
      { name
  
negative.code: 
    options = {
  
      security.pam.loginLimits = mkOption {
        default = [];
        example =
          [ { domain = "ftp";
              type   = "hard";
              item   = "nproc";
              value  = "0";
            }
            { domain = "@student";
              type   = "-";
              item   = "maxlogins";
              value  = "4";
            }
         ];
  
       description =
         '' Define resource limits that should apply to users or groups for the
            <command>login</command> service.  Each item in the list should be
            an attribute set with a <varname>domain</varname>,
            <varname>type</varname>, <varname>item</varname>, and
            <varname>value</varname> attribute.  The syntax and semantics of
            these attributes must be that described in the limits.conf(5) man
            page.
         '';
      };
  
      security.pam.services = mkOption {
        default = [];
        example = [
          { name = "chsh"; rootOK = true; }
          { name = "login"; ownDevices = true; allowNullPassword = true;
            limits = [
              { domain = "ftp";
                type   = "hard";
                item   = "nproc";
                value  = "0";
              }
            ];
          }
        ];
  
        description =
          ''
            This option defines the PAM services.  A service typically
  