anchor.diff:                "auth sufficient ${pam_usb}/lib/security/pam_usb.so"}
             ${optionalString config.users.ldap.enable
                 "auth sufficient ${pam_ldap}/lib/security/pam_ldap.so"}
  -          auth sufficient ${pam_unix2}/lib/security/pam_unix2.so ${
  +          auth sufficient pam_unix.so ${
               optionalString allowNullPassword "nullok"}
             auth required   pam_deny.so
   
             # Password management.
             ${optionalString config.users.ldap.enable
                 "password sufficient ${pam_ldap}/lib/security/pam_ldap.so"}
  -          password requisite ${pam_unix2}/lib/security/pam_unix2.so nullok
  +          password requisite pam_unix.so nullok sha512
             ${optionalString config.services.samba.syncPasswordsByPam
                 "password optional ${pkgs.samba}/lib/security/pam_smbpass.so nullok use_authtok try_first_pass"}
   
             # Session management.
             ${optionalString config.users.ldap.enable
                 "session optional ${pam_ldap}/lib/security/pam_ldap.so"}
  -          session required ${pam_unix2}/lib/security/pam_unix2.so
  +          session required pam_unix.so
             ${optionalString ownDevices
                 "session optional ${pkgs.consolekit}/lib/security/pam_ck_connector.so"}
             ${optionalString forwardXAuth
  
positive.code:           # Account management.
            ${optionalString config.users.ldap.enable
                "account optional ${pam_ldap}/lib/security/pam_ldap.so"}
            account required ${pam_unix2}/lib/security/pam_unix2.so
  
            # Authentication management.
            ${optionalString rootOK
  
negative.code:   
      environment.systemPackages =
        # Include the PAM modules in the system path mostly for the manpages.
        [ pkgs.pam ]
        ++ optional config.users.ldap.enable pam_ldap;
  
      environment.etc =
  