anchor.diff:                "session optional ${pam_ldap}/lib/security/pam_ldap.so"}
             ${optionalString config.krb5.enable
                 "session optional ${pam_krb5}/lib/security/pam_krb5.so"}
  +          ${optionalString otpwAuth
  +              "session optional ${pkgs.otpw}/lib/security/pam_otpw.so"}
             ${optionalString startSession
                 "session optional ${pkgs.systemd}/lib/security/pam_systemd.so"}
             ${optionalString forwardXAuth
  
positive.code:         '';
      };
  
      users.motd = mkOption {
        default = null;
        example = "Today is Sweetmorn, the 4th day of The Aftermath in the YOLD 3178.";
  
negative.code:               "auth sufficient ${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so file=~/.ssh/authorized_keys:~/.ssh/authorized_keys2:/etc/ssh/authorized_keys.d/%u"}
            ${optionalString usbAuth
                "auth sufficient ${pkgs.pam_usb}/lib/security/pam_usb.so"}
            ${optionalString otpwAuth
                "auth sufficient ${pkgs.otpw}/lib/security/pam_otpw.so"}
            auth sufficient pam_unix.so ${optionalString allowNullPassword "nullok"} likeauth
            ${optionalString config.users.ldap.enable
                "auth sufficient ${pam_ldap}/lib/security/pam_ldap.so use_first_pass"}
  