sshd_config ForceCommand /usr/bin/rsync error "connection unexpectedly closed"

Solution 1:

The why is easy... ForceCommand does exactly what it says: You connect, it forces you to run that command no matter what you actually wanted to do. In this case, that command is /usr/bin/rsync with no flags.

rsync works by running another copy of rsync on the other side of the connection and talking to it over ssh. In this case though, it's unable to start the other side with the flags it needs because the command is replaced by /usr/bin/rsync

Your rsync-validate script is probably the best way to go about this. It checks the request to make sure it is a valid rsync server command, and only then does it run it. rsync probably could be modified to check the $SSH_ORIGINAL_COMMAND directly when its run without arguments, but there's probably a good security reason not to do so.

Solution 2:

The ForceCommand option is meant to be used with a command that specifically understands that it's acting as an SSH gatekeeper. The original command is placed in the SSH_ORIGINAL_COMMAND environment variable.