anchor.diff:          '';
         };
   
  -      challengeResponseAuthentication = mkOption {
  +      kbdInteractiveAuthentication = mkOption {
           type = types.bool;
           default = true;
           description = ''
  -          Specifies whether challenge/response authentication is allowed.
  +          Specifies whether keyboard-interactive authentication is allowed.
           '';
         };
   
  
positive.code:   imports = [
      (mkAliasOptionModule [ "services" "sshd" "enable" ] [ "services" "openssh" "enable" ])
      (mkAliasOptionModule [ "services" "openssh" "knownHosts" ] [ "programs" "ssh" "knownHosts" ])
    ];
  
    ###### interface
  
negative.code:         PermitRootLogin ${cfg.permitRootLogin}
          GatewayPorts ${cfg.gatewayPorts}
          PasswordAuthentication ${if cfg.passwordAuthentication then "yes" else "no"}
          KbdInteractiveAuthentication ${if cfg.kbdInteractiveAuthentication then "yes" else "no"}
  
          PrintMotd no # handled by pam_motd
  
  