If the datastore is on ZFS you could also use zfs send/receive to replicate the data to another host. rsync.net for example allows this:
https://www.rsync.net/products/zfsintro.html
For USB or other external drives you can use the function for removable datastores or tape backups for air-gapped backup.
Concerning ransomware protection of the regular PBS backups the best approach would be to configure the remote pbs to do a pull-sync from your local PBS so you only need to allow access from the remote pbs to the local pbs:
https://pbs.proxmox.com/docs/storage.html#ransomware-protection-recovery
With that you would setup the PBS hosts like this:
- Remote PBS doesn't allow incoming connections by default (via iptables rules or some other firewall), the PBS permissions allows restoring the backups but nothing else. A pull-sync job pulls backups from the local PBS.
- Local PBS allows incomming connections from the PBS and your ProxmoxVE hosts for pulling,writing and restoring backups (again on a firewall level). PBS permissions allow that the PVE hosts can create and restore backups but not removing or editing them. The remote PBS is allowed to pull backups but not to edit or remove them
Normally, no connection to the remote PBS is possible, which ultimately makes ransomware attacks impossible. If you need a backup from the remote PBS you would create a temporary exception in the firewall, restore/pull the backup and afterwards remove the exception.
HTH
