anchor.diff:          '';
       };
   
  +    security.pam.enableOTPW = mkOption {
  +      default = false;
  +      description = ''
  +        Enable the OTPW (one-time password) PAM module
  +      '';
  +    };
  +
       users.motd = mkOption {
         default = null;
         example = "Today is Sweetmorn, the 4th day of The Aftermath in the YOLD 3178.";
  
positive.code:               "session optional ${pam_ldap}/lib/security/pam_ldap.so"}
            ${optionalString config.krb5.enable
                "session optional ${pam_krb5}/lib/security/pam_krb5.so"}
            ${optionalString startSession
                "session optional ${pkgs.systemd}/lib/security/pam_systemd.so"}
            ${optionalString forwardXAuth
  
negative.code:       # Include the PAM modules in the system path mostly for the manpages.
        [ pkgs.pam ]
        ++ optional config.users.ldap.enable pam_ldap
        ++ optionals config.krb5.enable [pam_krb5 pam_ccreds]
        ++ optionals config.security.pam.enableOTPW [ pkgs.otpw ];
  
      environment.etc =
        map makePAMService config.security.pam.services
  