anchor.diff:            Specifies on which ports the SSH daemon listens.
           '';
         };
  -      
  +
  +      usePAM = mkOption {
  +        default = true;
  +        description = ''
  +          Specifies whether the OpenSSH daemon uses PAM to authenticate
  +          login attempts.
  +        '';
  +      };
  +
  +      passwordAuthentication = mkOption {
  +        default = true;
  +        description = ''
  +          Specifies whether password authentication is allowed. Note
  +          that setting this value to <literal>false</literal> is most
  +          probably not going to have the desired effect unless
  +          <literal>usePAM</literal> is disabled as well.
  +        '';
  +      };
  +
         extraConfig = mkOption {
           default = "";
           description = "Verbatim contents of <filename>sshd_config</filename>.";
  
positive.code: 
          PermitRootLogin ${cfg.permitRootLogin}
          GatewayPorts ${cfg.gatewayPorts}
        '';
  
    };
  
negative.code:       ''
          Protocol 2
  
          UsePAM ${if cfg.usePAM then "yes" else "no"}
  
          ${concatMapStrings (port: ''
            Port ${toString port}
  