> What we have done is setup ssh in a very restricted fashion to ssh to the
> DMZ, and tar the contents of the web server across the ssh tunnel to a local box
> that is then backed up on the private network.

This is what rsync is for. 

> This works well for a medium amount of data and is very secure.

rsync works pretty well for a large amount of data, since it only moves
changes. If you want snapshots of each backup, that can be handled on the
backup server. 

Andy