@scottalanmiller said in Enterprise 15K SAS drives vs consumer grade SSD in a Dell server?:

@dave247 said in Enterprise 15K SAS drives vs consumer grade SSD in a Dell server?:

@scottalanmiller said in Enterprise 15K SAS drives vs consumer grade SSD in a Dell server?:

@dave247 said in Enterprise 15K SAS drives vs consumer grade SSD in a Dell server?:

My thinking is that I'd like the OS partition to be fast as possible, because why not.

Because this is totally useless and has no purpose and goes against everything. It will make the things that matter slow while speeding up the thing you will never use. It wastes capacity and you don't have very much of that to spare.

https://www.smbitjournal.com/2015/02/slow-os-drives-fast-data-drives/

Yeah I'm already aware of that. My limitation now is that I don't have 8 drives of the desired capacity to make OBR10. So I'm just setting up a RAID1 volume for the OS. Then it comes down to the question I made my post about.

So you have spare bays? That's a bit different. If you have extra bays, and spare drives, and nowhere else to use them... then whatever. How many spare bays do you have after you use up your 15K drives? A RAID 1 might not make sense. A larger RAID 5 might make sense (with the SSDs) and put some VHDs there.

I put all this in my original post

I have 8 bays in my R510. Right now, I just want to install Hyper-V, on a single drive, or two drives in RAID1. Then later, when I have a chance, I'm going to acquire 6 high capacity drives to put in a RAID10 which I can use for storage to hold virtual machines.

@scottalanmiller said in Enterprise 15K SAS drives vs consumer grade SSD in a Dell server?:

@dave247 said in Enterprise 15K SAS drives vs consumer grade SSD in a Dell server?:

My thinking is that I'd like the OS partition to be fast as possible, because why not.

Because this is totally useless and has no purpose and goes against everything. It will make the things that matter slow while speeding up the thing you will never use. It wastes capacity and you don't have very much of that to spare.

https://www.smbitjournal.com/2015/02/slow-os-drives-fast-data-drives/

Yeah I'm already aware of that. My limitation now is that I don't have 8 drives of the desired capacity to make OBR10. So I'm just setting up a RAID1 volume for the OS. Then it comes down to the question I made my post about.

@dustinb3403 said in Enterprise 15K SAS drives vs consumer grade SSD in a Dell server?:

@dave247 said in Enterprise 15K SAS drives vs consumer grade SSD in a Dell server?:

My thinking is that I'd like the OS partition to be fast as possible, because why not.

Hypervisors have stupidly low IOPS requirements.

It would be look cooking a hotdog by standing behind a fight jet as it preps to take off.

hahaha .. ok then it's settled. I'll just throw in the SAS drives. I guess I'm being silly about this...

@dustinb3403 said in Enterprise 15K SAS drives vs consumer grade SSD in a Dell server?:

If you wanted to use SSD's I'd hit up xbyte and see if they have any decent deals going that might work well.

I don't want to buy anything right now. I want to use parts I currently have on hand.

@scottalanmiller said in Enterprise 15K SAS drives vs consumer grade SSD in a Dell server?:

The 15K drives have a lot more capacity here. For most lab purposes, that will be far more useful.

Well I want Hyper-V on these drives I'm talking about, then later I plan to have a huge RAID10 volume in the remaining 6 slots - like 4TB or something.

My thinking is that I'd like the OS partition to be fast as possible, because why not.

I'm putting Hyper-V on a decommissioned Dell R510 for a general LAB environment and testing, etc. I'm trying to scrounge up some spare drives (I have a lot) for a stable/reliable config. I have 8x 3.5" drive bays on this thing and my plan is to use slot 0 and 1 for two drives in RAID1 for the OS, then use the rest for a RAID10 array for storage (at a later time). Yes, I know usually you'd just do OBR10 but I'm not doing it that way.

Right now, I'm trying to decide which would be better: a set of 300GB 15K SAS Dell Enterprise drives or a set of consumer-grade 128GB Samsung 840 Pro SSD drives.

I assume both will work fine but I've never really used consumer SSD's on a Dell server before.. input?

@scottalanmiller said in Best DNS choice for a financial institution?:

@jaredbusch said in Best DNS choice for a financial institution?:

@scottalanmiller said in Best DNS choice for a financial institution?:

@dave247 said in Best DNS choice for a financial institution?:

@scottalanmiller said in Best DNS choice for a financial institution?:

@dave247 said in Best DNS choice for a financial institution?:

@scottalanmiller said in Best DNS choice for a financial institution?:

@dave247 said in Best DNS choice for a financial institution?:

So then what good/safe/secure/reliable/free DNS servers should I be using?? All I know of right now is google and DNSwatch..

Google. It's what everyone uses. Unless you are going to pay for something, which is perfectly fine as things like Cisco Umbrella really do a good job, you just use Google. Google's DNS servers are screaming fast, insanely secure, and standard the world over. Google's only competition was OpenDNS' free servers and they were only competitive when they did free filtering and other tools. Without that, Google is still the best. So no reason to look around for anything else.

rips hair out google it is then

LOL, remember it is IT, "keeping it simple" is often the right answer.

Yeah I can't remember why, but for some reason I remember changing my thoughts about "just setting DNS to google" ... like it wasn't the best thing to do or something.

Best thing is likely a service like Umbrella. But for free, nothing will touch Google.

An alternative to Umbrella is Strongarm.io. They have recently added content filtering options to their service which was originally only designed to interrupt connections to malicious sites.

Yes. Probably much cheaper than Cisco, too. OpenDNS was great before Cisco bought them. I'd personally be pretty wary of using a Cisco service, my interactions with Cisco are pretty consistent that they lack integrity and so I don't see them as a company I would trust in any situation where they were involved in security. They don't seem to have a lot of ethics and that is a big deal when talking about security products - what good is their security if you can't trust the people who are the security people!

Definitely check out Strongarm.io. If you are going to be in Austin in two weeks, Strongarm will be hanging out with us on Sixth!

Same impression I get

@scottalanmiller said in Best DNS choice for a financial institution?:

@dave247 said in Best DNS choice for a financial institution?:

@scottalanmiller said in Best DNS choice for a financial institution?:

@dave247 said in Best DNS choice for a financial institution?:

So then what good/safe/secure/reliable/free DNS servers should I be using?? All I know of right now is google and DNSwatch..

Google. It's what everyone uses. Unless you are going to pay for something, which is perfectly fine as things like Cisco Umbrella really do a good job, you just use Google. Google's DNS servers are screaming fast, insanely secure, and standard the world over. Google's only competition was OpenDNS' free servers and they were only competitive when they did free filtering and other tools. Without that, Google is still the best. So no reason to look around for anything else.

rips hair out google it is then

LOL, remember it is IT, "keeping it simple" is often the right answer.

Yeah I can't remember why, but for some reason I remember changing my thoughts about "just setting DNS to google" ... like it wasn't the best thing to do or something.

@scottalanmiller said in Best DNS choice for a financial institution?:

@dave247 said in Best DNS choice for a financial institution?:

So then what good/safe/secure/reliable/free DNS servers should I be using?? All I know of right now is google and DNSwatch..

Google. It's what everyone uses. Unless you are going to pay for something, which is perfectly fine as things like Cisco Umbrella really do a good job, you just use Google. Google's DNS servers are screaming fast, insanely secure, and standard the world over. Google's only competition was OpenDNS' free servers and they were only competitive when they did free filtering and other tools. Without that, Google is still the best. So no reason to look around for anything else.

rips hair out google it is then

@scottalanmiller said in Best DNS choice for a financial institution?:

@dave247 said in Best DNS choice for a financial institution?:

@scottalanmiller said in Best DNS choice for a financial institution?:

@dave247 said in Best DNS choice for a financial institution?:

I just reverted my DNS settings to what they were before. Screw it.

That's the one thing I would not do. If you are concerned about speed or security, you never use ISP DNS. That's been a best practice for over a decade (since the advent of free, enterprise DNS options like Google.) The one option that should never get considered is ISP DNS.

Why is that?

Because ISPs have these issues:

• It is not a service that they make money or clout on. They provide it because they have to for consumers. They don't care about making it good or safe, this is not in their interest. So it makes no business sense for them to do it well, or for customers to expect it to be a good service.
• ISP DNS is famously slow and risky, for exactly the reasons above. It is where attacks happen because ISPs aren't DNS specialists, they just throw up free DNS servers and ignore them. So DNS Injection attacks happen here. That entire, and very major, attack vector exists solely for companies that use ISP DNS. Google and Cisco have never been hacked like this, it's not a realistic attack on them.
• Propagation is notoriously problematic and unknown. Causing delays in failover or outages as other services change and you do not.
• You are unnecessarily tied to the ISP, even in a very trivial way.
• You make things non-standard for no reason. Why make things extra hard for negative benefits?
• You will have to have discussions like this every time you talk about DNS internally or externally. Making it a financial loss without benefit. Just use Google like everyone else and be done and eliminate having to explain the use of ISP DNS anytime someone looks at the system.
• Multiple sites can share configuration.
• Services like Google and OpenDNS take pride in their high availability, your ISP does not.
• If you switch ISPs, have an outage, etc. you get to keep configuration instead of needing to manually change anytime anything else changes.

So then what good/safe/secure/reliable/free DNS servers should I be using?? All I know of right now is google and DNSwatch..

@jaredbusch said in Best DNS choice for a financial institution?:

@dashrender said in Best DNS choice for a financial institution?:

@reid-cooper said in Best DNS choice for a financial institution?:

OpenDNS is good. Or just use Google, it's not bad.

For pure DNS probably so - but the OP is claiming (and JB is refuting) that OpenDNS provides filtering for free that no one else does.

And from my own testing about 3 years ago, I agree with the OP, OpenDNS did provide a free level of filtering, but I don't recall what the limitations were.

OpenDNS does provide a free service. But that is not what was stated, nor what I refuted.

What was stated was to simply put the OpenDNS servers in as your DNS. That does nothing. It is a public DNS service. To make use of the basic filtering you have to create an account and link everything up.

But all of that said, you are also using the service against the ToS. There is no free service available for commercial use. There is only a trial for Umbrella.

For OpenDNS Home, it specifically states that it is for home use in the ToS.

Still not really helping the convo..

@scottalanmiller said in Best DNS choice for a financial institution?:

@dave247 said in Best DNS choice for a financial institution?:

I just reverted my DNS settings to what they were before. Screw it.

That's the one thing I would not do. If you are concerned about speed or security, you never use ISP DNS. That's been a best practice for over a decade (since the advent of free, enterprise DNS options like Google.) The one option that should never get considered is ISP DNS.

Why is that?

@marcinozga said in Best DNS choice for a financial institution?:

@dave247 Why? ISP DNS servers are the worst thing you can pick. If you don't want to mess with OpenDNS, go with Google servers.

Got any good info to back that statement up? I'm not saying I don't believe you, but I've always just heard that via word of mouth.. not sure if it's really true or not

I just reverted my DNS settings to what they were before. Screw it.

@dashrender said in Best DNS choice for a financial institution?:

@danp said in Best DNS choice for a financial institution?:

@jaredbusch said in Best DNS choice for a financial institution?:

@dave247 said in Best DNS choice for a financial institution?:

@coliver said in Best DNS choice for a financial institution?:

I don't see anything wrong with this. OpenDNS, Google DNS, Comodo DNS, are all big names that are very unlikely to fall victim to DNS poisoning attacks.

Yeah I was just trying OpenDNS out because someone mentioned that they seem to filter out some "bad"/spam sites and things of that nature. Example: I've had some people accidentally type the wrong URL (off by a letter) and it takes them to a malicious website.

They do no such thing.

How would you classify this functionality then?

is that in the free service?

This is really all I was going for.. better than nothing

@jaredbusch said in Best DNS choice for a financial institution?:

@dave247 said in Best DNS choice for a financial institution?:

@coliver said in Best DNS choice for a financial institution?:

I don't see anything wrong with this. OpenDNS, Google DNS, Comodo DNS, are all big names that are very unlikely to fall victim to DNS poisoning attacks.

Yeah I was just trying OpenDNS out because someone mentioned that they seem to filter out some "bad"/spam sites and things of that nature. Example: I've had some people accidentally type the wrong URL (off by a letter) and it takes them to a malicious website.

They do no such thing.

Not really helpful.

@travisdh1 said in Best DNS choice for a financial institution?:

@dave247 OpenDNS is just fine to use, like the other major DNS providers they will probably be a step up from your ISP provided service.

What they don't do is filtering of any kind unless you add a paid service on. I've started running my own DNS server now that does block known advertising IP addresses called Pi-Hole (Yes, I've seen many names that are better.)

Ah yes, that really makes sense now that you mention it.

@coliver said in Best DNS choice for a financial institution?:

I don't see anything wrong with this. OpenDNS, Google DNS, Comodo DNS, are all big names that are very unlikely to fall victim to DNS poisoning attacks.

Yeah I was just trying OpenDNS out because someone mentioned that they seem to filter out some "bad"/spam sites and things of that nature. Example: I've had some people accidentally type the wrong URL (off by a letter) and it takes them to a malicious website.

I work at a financial institution and am currently the only sysadmin here. I'm still green and learning as I go.
I've been working to improve security by cleaning up firewall access rules and other things. One thing I did recently was switch our DNS from the ISP provided addresses to OpenDNS's servers. I just made the change but then I had the thought, is this ok to do? Is this secure?

Does anyone know if it's wise for me to use OpenDNS or if I should look into any other DNS options? Any input is welcome.