anchor.diff:  <% end -%>
   
   <% if @options['AuthorizedPrincipalsFile'] -%>
  -AuthorizedPrincipalsFile <%= options['AuthorizedPrincipalsFile'] %>
  +AuthorizedPrincipalsFile <%= @options['AuthorizedPrincipalsFile'] %>
   <% else -%>
   #AuthorizedPrincipalsFile none
   <% end -%>
   
   <% if @options['AuthorizedKeysCommand'] -%>
  -AuthorizedKeysCommand <%= options['AuthorizedKeysCommand'] %>
  +AuthorizedKeysCommand <%= @options['AuthorizedKeysCommand'] %>
   <% else -%>
   #AuthorizedKeysCommand none
   <% end -%>
   <% if @options['AuthorizedKeysCommandUser'] -%>
  -AuthorizedKeysCommandUser <%= options['AuthorizedKeysCommandUser'] %>
  +AuthorizedKeysCommandUser <%= @options['AuthorizedKeysCommandUser'] %>
   <% else -%>
   #AuthorizedKeysCommandUser nobody
   <% end -%>
   
   # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
   <% if @options['RhostsRSAAuthentication'] -%>
  -RhostsRSAAuthentication <%= options['RhostsRSAAuthentication'] %>
  +RhostsRSAAuthentication <%= @options['RhostsRSAAuthentication'] %>
   <% else -%>
   #RhostsRSAAuthentication no
   <% end -%>
   # similar for protocol version 2
   <% if @options['HostbasedAuthentication'] -%>
  -HostbasedAuthentication <%= options['HostbasedAuthentication'] %>
  +HostbasedAuthentication <%= @options['HostbasedAuthentication'] %>
   <% else -%>
   #HostbasedAuthentication no
   <% end -%>
   # Change to yes if you don't trust ~/.ssh/known_hosts for
   # RhostsRSAAuthentication and HostbasedAuthentication
   <% if @options['IgnoreUserKnownHosts'] -%>
  -IgnoreUserKnownHosts <%= options['IgnoreUserKnownHosts'] %>
  +IgnoreUserKnownHosts <%= @options['IgnoreUserKnownHosts'] %>
   <% else -%>
   #IgnoreUserKnownHosts no
   <% end -%>
   # Don't read the user's ~/.rhosts and ~/.shosts files
   <% if @options['IgnoreRhosts'] -%>
  -IgnoreRhosts <%= options['IgnoreRhosts'] %>
  +IgnoreRhosts <%= @options['IgnoreRhosts'] %>
   <% else -%>
   #IgnoreRhosts yes
   <% end -%>
   
   # To disable tunneled clear text passwords, change to no here!
   <% if @options['PasswordAuthentication'] -%>
  -PasswordAuthentication <%= options['PasswordAuthentication'] %>
  +PasswordAuthentication <%= @options['PasswordAuthentication'] %>
   <% else -%>
   #PasswordAuthentication yes
   <% end -%>
   <% if @options['PermitEmptyPasswords'] -%>
  -PermitEmptyPasswords <%= options['PermitEmptyPasswords'] %>
  +PermitEmptyPasswords <%= @options['PermitEmptyPasswords'] %>
   <% else -%>
   #PermitEmptyPasswords no
   <% end -%>
   
   # Change to no to disable s/key passwords
   <% if @options['ChallengeResponseAuthentication'] -%>
  -ChallengeResponseAuthentication <%= options['ChallengeResponseAuthentication'] %>
  +ChallengeResponseAuthentication <%= @options['ChallengeResponseAuthentication'] %>
   <% else -%>
   #ChallengeResponseAuthentication yes
   <% end -%>
   
   # Kerberos options
   <% if @options['KerberosAuthentication'] -%>
  -KerberosAuthentication <%= options['KerberosAuthentication'] %>
  +KerberosAuthentication <%= @options['KerberosAuthentication'] %>
   <% else -%>
   #KerberosAuthentication no
   <% end -%>
   <% if @options['KerberosOrLocalPasswd'] -%>
  -KerberosOrLocalPasswd <%= options['KerberosOrLocalPasswd'] %>
  +KerberosOrLocalPasswd <%= @options['KerberosOrLocalPasswd'] %>
   <% else -%>
   #KerberosOrLocalPasswd yes
   <% end -%>
   <% if @options['KerberosTicketCleanup'] -%>
  -KerberosTicketCleanup <%= options['KerberosTicketCleanup'] %>
  +KerberosTicketCleanup <%= @options['KerberosTicketCleanup'] %>
   <% else -%>
   #KerberosTicketCleanup yes
   <% end -%>
   <% if @options['KerberosGetAFSToken'] -%>
  -KerberosGetAFSToken <%= options['KerberosGetAFSToken'] %>
  +KerberosGetAFSToken <%= @options['KerberosGetAFSToken'] %>
   <% else -%>
   #KerberosGetAFSToken no
   <% end -%>
   
   # GSSAPI options
   <% if @options['GSSAPIAuthentication'] -%>
  -GSSAPIAuthentication <%= options['GSSAPIAuthentication'] %>
  +GSSAPIAuthentication <%= @options['GSSAPIAuthentication'] %>
   <% else -%>
   #GSSAPIAuthentication no
   <% end -%>
   <% if @options['GSSAPICleanupCredentials'] -%>
  -GSSAPICleanupCredentials <%= options['GSSAPICleanupCredentials'] %>
  +GSSAPICleanupCredentials <%= @options['GSSAPICleanupCredentials'] %>
   <% else -%>
   #GSSAPICleanupCredentials yes
   <% end -%>
  
positive.code: <% end -%>
  
  <% if @options['AcceptEnv'] -%>
  <% if options['AcceptEnv'].respond_to?('each') -%>
  <% options['AcceptEnv'].each do |env| -%>
  AcceptEnv <%= env %>
  <% end -%>
  <% else -%>
  AcceptEnv <%= options['AcceptEnv'] %>
  <% end -%>
  <% else -%>
  <% if @osfamily == 'Debian' -%>
  
negative.code: 
  
  <% if @options['Port'] -%>
  Port <%= @options['Port'] %>
  <% else -%>
  #Port 22
  <% end -%>
  <% if @options['AddressFamily'] -%>
  AddressFamily <%= @options['AddressFamily'] %>
  <% else -%>
  #AddressFamily any
  <% end -%>
  