[mikebos]

Most ransomware now a days stays hidden for a long time to try to invalidate your backups. I would just restrict access (physical and remote) to the maximum. So the datastore is just that, no other function on the server. Only access through an api or a well understood protocol, think rsync, ftp, whatever. Do the back-up locally to a non writeable directory / disk for non root users.