The system administrator wishes to use the pam_listfile.so module to restrict which users are allowed to login via SSH. Which line will configure this behaviour?

Using `sense=deny` would mean users in `/etc/sshd/sshd.deny` are denied, but `onerr=succeed` would allow access if the deny file isn't found, which is a security risk.

Using `onerr=succeed` with `sense=allow` means if `/etc/sshd/sshd.allow` cannot be read, the module would succeed, potentially allowing unauthorized users to log in.

The `item=user` specifies to check the username, `sense=allow` means to permit access only if the user is found in the specified `file`, and `onerr=fail` ensures that if the file cannot be accessed or read, the authentication attempt will fail, enhancing security by failing safe.

Using `sense=deny` with `onerr=fail` means users listed in `/etc/sshd/sshd.deny` would be denied, and if the file is unreadable, it fails (denies), but the question implies restricting to a list, not denying from a list.