Debian: SSH: "PermitRootLogin=forced-commands-only" stopped working

"PermitRootLogin forced-commands-only" requires that all connections, via SSH as root, need to use public key authentication and that a command be associated with that key (like 'validate-rsync').

If you want to login as root but only with keys use:

PermitRootLogin = without-password

To restrict rsync to a defined ssh-key you can specify in your authorized_keys:

from="<ip>",command="/usr/local/sbin/validate-rsync" ssh-dss AAAAZ5Hbl......

And save this wrapper to: /usr/local/sbin/validate-rsync

#!/bin/sh 

case "$SSH_ORIGINAL_COMMAND" in 
*\&*) 
echo "Rejected" 
;; 
*\(*) 
echo "Rejected" 
;; 
*\{*) 
echo "Rejected" 
;; 
*\;*) 
echo "Rejected" 
;; 
*\<*) 
echo "Rejected" 
;; 
*\`*) 
echo "Rejected" 
;; 
*\|*) 
echo "Rejected" 
;; 
rsync\ --server*) 
$SSH_ORIGINAL_COMMAND 
;; 
*) 
echo "Rejected" 
;; 
esac 

There is a slightly more complicated script shipped with rsync to do the same, http://www.samba.org/ftp/unpacked/rsync/support/rrsync