anchor.diff:              || cfg.pamMount
               || cfg.enableKwallet
               || cfg.enableGnomeKeyring
  -            || cfg.googleAuthenticator.enable)) ''
  +            || cfg.googleAuthenticator.enable
  +            || cfg.duoSecurity.enable)) ''
                 auth required pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} likeauth
                 ${optionalString config.security.pam.enableEcryptfs
                   "auth optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so unwrap"}
  
positive.code:           <filename>~/.ssh/authorized_keys</filename>.  This is useful
            for <command>sudo</command> on password-less remote systems.
          '';
        };
  
        startSession = mkOption {
  
negative.code:                 ("auth optional ${pkgs.plasma5.kwallet-pam}/lib/security/pam_kwallet5.so" +
                   " kwalletd=${pkgs.libsForQt5.kwallet.bin}/bin/kwalletd5")}
                ${optionalString cfg.enableGnomeKeyring
                  "auth optional ${pkgs.gnome3.gnome-keyring}/lib/security/pam_gnome_keyring.so"}
                ${optionalString cfg.googleAuthenticator.enable
                  "auth required ${pkgs.googleAuthenticator}/lib/security/pam_google_authenticator.so no_increment_hotp"}
                ${optionalString cfg.duoSecurity.enable
                  "auth required ${pkgs.duo-unix}/lib/security/pam_duo.so"}
              '') + ''
            ${optionalString cfg.unixAuth
                "auth sufficient pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} likeauth try_first_pass"}
  