anchor.diff:  
   let
   
  -  inherit (pkgs) pam_unix2 pam_usb pam_ldap;
  +  inherit (pkgs) pam_usb pam_ldap;
   
     otherService = pkgs.writeText "other.pam"
       ''
  
positive.code:       # set (i.e., have an empty password field in /etc/passwd or
        # /etc/group).  This does not enable logging into disabled
        # accounts (i.e., that have the password field set to `!').
        # Note that regardless of what the pam_unix2 documentation says,
        # accounts with hashed empty passwords are always allowed to log
        # in.
        allowNullPassword ? false
  
negative.code:   
      environment.systemPackages =
        # Include the PAM modules in the system path mostly for the manpages.
        [ pkgs.pam ]
        ++ optional config.users.ldap.enable pam_ldap;
  
      environment.etc =
  