A script to use as an SSH ForceCommand that only lets root connect to run rsync in the way FreeNAS/TrueNAS does it.

force_rsync.sh

#!/bin/sh
expect='rsync --server --sender -logDtprze.LsfxC . /'
dir="/${SSH_ORIGINAL_COMMAND#$expect}"

# Try without compression
if [ "$dir" = "/${SSH_ORIGINAL_COMMAND}" ]; then
        expect='rsync --server --sender -logDtpre.LsfxC . /'
        dir="/${SSH_ORIGINAL_COMMAND#$expect}"
fi

if [ "$dir" != "/${SSH_ORIGINAL_COMMAND}" -a -e "$dir" ]; then
        exec ${SSH_ORIGINAL_COMMAND} -vvv
fi

set -- ${SSH_CONNECTION}
SRC="$1 port $2"
DST="$3 port $4"

logger -t force_rsync -p auth.warning \
    "Invalid rsync command from user ${USER} ${SRC}: [${SSH_ORIGINAL_COMMAND}]"