anchor.diff:    
       environment.systemPackages =
         # Include the PAM modules in the system path mostly for the manpages.
  -      [ pkgs.pam pam_unix2 ]
  +      [ pkgs.pam ]
         ++ optional config.users.ldap.enable pam_ldap;
   
       environment.etc =
  
positive.code:           # Account management.
            ${optionalString config.users.ldap.enable
                "account optional ${pam_ldap}/lib/security/pam_ldap.so"}
            account required ${pam_unix2}/lib/security/pam_unix2.so
  
            # Authentication management.
            ${optionalString rootOK
  
negative.code:               "auth sufficient ${pam_usb}/lib/security/pam_usb.so"}
            ${optionalString config.users.ldap.enable
                "auth sufficient ${pam_ldap}/lib/security/pam_ldap.so"}
            auth sufficient pam_unix.so ${
              optionalString allowNullPassword "nullok"}
            auth required   pam_deny.so
  
            # Password management.
            ${optionalString config.users.ldap.enable
                "password sufficient ${pam_ldap}/lib/security/pam_ldap.so"}
            password requisite pam_unix.so nullok sha512
            ${optionalString config.services.samba.syncPasswordsByPam
                "password optional ${pkgs.samba}/lib/security/pam_smbpass.so nullok use_authtok try_first_pass"}
  
            # Session management.
            ${optionalString config.users.ldap.enable
                "session optional ${pam_ldap}/lib/security/pam_ldap.so"}
            session required pam_unix.so
            ${optionalString ownDevices
                "session optional ${pkgs.consolekit}/lib/security/pam_ck_connector.so"}
            ${optionalString forwardXAuth
  