In the absence of any reply to the above queries, I'll have to make an assumption: specifically, that you wish to continue to allow the
nisse user to log in to assist with the
This is the requirement that's complicating your usage case, and it's indicative of a poor requirement. The usual method of stopping further users from logging in is to touch
/etc/nologin; in addition, anything you put into that file will be printed as a rejection banner. This will stop connections via
rsync -e ssh. It won't log out any current users, so if you're worried about nisse being thrown off before launching the
rsync, don't be.
rm /etc/nologin once you're done.
If the issue is that
nisse must log in after the ban is in place, as part of the
rsync, you're doing the
rsync backwards. Log in, create
/etc/nologin, then use
rsync to push from the current server, instead of pulling from the new one.
If there is some other business-critical reason for
nisse's exception that I haven't covered, then andol is right when (s)he points out above that modifying your current
AllowUsers settings is pretty much the perfect way to achieve the granularity you require. While you're there, you can further modify your
sshd_config to use
Banner to print a banner before rejection, and
nisse can be told to ignore it.