Is /etc/rc.local a good place to run a script before any (normal) user can log in?

Usually /etc/rc.local is the valid option, but it also depends on the amount of work that is involved in "syncing some stuff" and how important it is that users cannot login before this action has completed.

If you want to make sure that the syncing has completed before users login, you can consider one of two "nologin" options.

1. Write a script that sets the login shell (of a particular group of users) to /usr/sbin/nologin before syncing and restores it after syncing.

2. Create an empty /etc/nologin file before syncing using touch /etc/nologin and remove it after syncing. Note that this option may easily lock you out if you disabled logging in as root over SSH, since it prevents all non-root accounts from logging in.

For the case you describe, calling your sync script from /etc/rc.local is a valid solution. It's the one I would probably go with as well, though there are undoubtedly other solutions that other people would come up with.

It's executed after all the "built-in" rc startup scripts, but before the login prompt is presented at the console. Do keep in mind, though, users will be able to log in to the system via SSH before rc.local is run. If this is a concern, you can put your script in the startup sequence after the network has started but before SSH is started. The reason I would still use rc.local and not worry about moving it's location is that the time between the SSH daemon starting and users realizing the system is available is in all likelihood far longer than it takes the system to get to and execute the rc.local script.

It looks like it is called after the system is ready to accepting logins from users. This is how I understand the "at the end of each multiuser runlevel".

No, /etc/rc.local get execute when system boot. ( When user login using ssh it will set environment and run scripts from /etc/profile ~/.bashrc, Read this page for more information. )

I was wondering whether calling the script from /etc/rc.local is the right place?

Yes, you can