This is a completely valid point. Why would you give access to the backup storage area to the production system? Where I have implemented it, the only access t

This is a completely valid point. Why would you give access to the backup storage area to the production system? Where I have implemented it, the only access the production system has to the backup system is to connect to an ssh server with a private key, and shove a tar down the pipe, which the backup system then squirrels away somewhere safe. This is a push configuration, but it's a safe one - the backup system doesn't have access to the production system either, and the production system cannot overwrite/delete any data on the backup system.