anchor.diff:          exec = "${openssh}/sbin/sshd -h /etc/ssh/ssh_host_dsa_key -f ${sshdConfig}";
         };
   
  -    networking.firewall.allowedTCPPorts = cfg.ports ;
  +    networking.firewall.allowedTCPPorts = cfg.ports;
             
     };
   
  
positive.code: 
        UsePAM yes
  
        ${ pkgs.lib.concatMapStrings (port : ''Port ${toString port}
                                             '') cfg.ports}
  
        ${if cfg.forwardX11 then "
  
negative.code: 
    config = mkIf config.services.sshd.enable {
  
      users.extraUsers = singleton
        { name = "sshd";
          uid = config.ids.uids.sshd;
          description = "SSH privilege separation user";
          home = "/var/empty";
        };
  
      environment.etc = singleton
        { source = "${openssh}/etc/ssh/moduli";
          target = "ssh/moduli";
        };
  
      jobs.sshd = {
  