anchor.diff:              || cfg.enableGnomeKeyring
               || cfg.googleAuthenticator.enable
               || cfg.duoSecurity.enable)) ''
  -              auth required pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} likeauth
  +              auth required pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} ${optionalString cfg.nodelay "nodelay"} likeauth
                 ${optionalString config.security.pam.enableEcryptfs
                   "auth optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so unwrap"}
                 ${optionalString cfg.pamMount
  
positive.code:           field set to <literal>!</literal>).  Note that regardless of
            what the pam_unix documentation says, accounts with hashed
            empty passwords are always allowed to log in.
          '';
        };
  
  
negative.code:                 "auth required ${pkgs.duo-unix}/lib/security/pam_duo.so"}
              '') + ''
            ${optionalString cfg.unixAuth
                "auth sufficient pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} ${optionalString cfg.nodelay "nodelay"} likeauth try_first_pass"}
            ${optionalString cfg.otpwAuth
                "auth sufficient ${pkgs.otpw}/lib/security/pam_otpw.so"}
            ${optionalString use_ldap
  