Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchA defensible GPU-server baseline has five parts: expose only role-required services, isolate the management plane, authenticate every administrator with phishing-resistant MFA where possible, patch the entire hardware and software stack, and repeatedly verify that the controls still match the deployment. There is no universal list of GPU-server ports. A DGX appliance, inference host, Kubernetes worker, storage node, and shared HPC node need different flows, so the approved port set must come from the documented service role and local architecture.
What this checklist is designed to protect
GPU servers combine ordinary operating-system risks with high-value accelerators, fast interconnects, storage, schedulers, containers, and often a separate baseboard management controller (BMC). A weakness in any layer can expose credentials, workloads, model data, firmware, or the wider cluster. The controls below apply to a single Linux GPU host, an appliance, and a multi-tenant HPC environment, but the implementation details differ by role.
As an Amazon Associate I earn from qualifying purchases.
Use the checklist as an evidence trail. For every decision, record the system owner, intended users, permitted source networks, destination, protocol, business or operational reason, and review date. A rule that has no owner or purpose should be treated as a candidate for removal.
1. Inventory listeners before writing firewall rules
Build a service and interface inventory
Start on the host and list every listening service, the address or interface on which it listens, its process owner, and the clients that are expected to connect. On Linux, ss -tulpen provides a useful first view of TCP and UDP listeners and their owning processes; lsof -i -P -n can help map sockets to programs. Confirm the results with the platform owner because a process can be legitimate while still listening on the wrong interface.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Record whether the listener is bound to loopback, a private service VLAN, a cluster fabric, a user-facing address, or all interfaces.
- Identify the package, container, systemd unit, or scheduler that starts it.
- Write down the intended client and source network, not merely the port number.
- Mark plaintext or obsolete protocols for removal. Telnet, FTP, and unneeded HTTP services should not remain enabled simply because they are easy to configure.
- Document dependencies such as DNS, time synchronization, identity, license servers, object storage, monitoring, and software repositories.
Validate the reachable boundary
Scan from each relevant trust boundary: an external test point, the user network, the management network, and the cluster or storage network. The observed listeners should match the approved inventory. Investigate anything unexpected rather than assuming that a firewall rule is effective because it exists in configuration. CISA guidance emphasizes minimal exposure, segmentation, trusted management devices, and logging denied traffic. Keep firewall changes in version-controlled procedures and review them after every deployment or topology change.
Why a universal GPU-port list is unsafe
Port requirements depend on the service role and architecture. Vendor deployment documentation and the locally approved design should define the exact allowlist. The following planning matrix shows what to document; it deliberately does not assign universal port numbers.
| Deployment role | Flows to specify | Primary trust boundary |
|---|---|---|
| General-purpose GPU host | Administrative access, monitoring, identity, software updates, and any published application endpoint | Management network versus user or application network |
| Inference or API server | Client API traffic, load-balancer health checks, model storage, telemetry, and administrator access | Public or application zone versus private management and storage zones |
| Kubernetes GPU worker | Control-plane traffic, node-to-node traffic, image and package retrieval, logging, and operator access | Cluster networks versus management and egress controls |
| HPC compute node | Scheduler, fabric, parallel filesystem, provisioning, monitoring, and emergency administration | Purpose-specific HPC networks and restricted management plane |
| Storage or data-service node with GPUs | Storage protocols, replication, GPU workload traffic, backup, monitoring, and administration | Storage and replication zones versus user and management zones |
| Appliance such as a DGX system | Vendor-defined service, support, BMC, cluster, storage, and update flows | Appliance management network and documented vendor architecture |
For each row in your environment, turn the inventory into rules that constrain both source and destination. A service that only needs to serve one subnet should not listen on or accept traffic from every interface.
Recommended Free Tools
2. Isolate BMC and other management access
Put the BMC on a dedicated network
Treat the BMC as a management-plane interface, not as another user-facing server address. NVIDIA states in the DGX H100/H200 User Guide, last updated January 26, 2026: “NVIDIA recommends that you connect the BMC port in the DGX H100/H200 system to a dedicated management network with firewall protection.” The DGX B300 User Guide, last updated October 5, 2026, gives the corresponding recommendation for that platform.
Use a dedicated, firewall-protected management segment with tightly scoped administrator sources. Do not bridge the BMC to an Internet-facing or general-purpose VLAN. Disable or restrict BMC services that the current operational procedure does not require, and apply the BMC vendor’s account, certificate, logging, and firmware settings.
Provide remote access through an isolated path
When remote BMC access is necessary, NVIDIA’s DGX guidance recommends an isolated secure method such as a VPN server rather than direct Internet exposure. Put the VPN or bastion under separate administrative control where practical, require individual identities, and log both the connection to the remote-access system and the subsequent BMC session. A VPN reduces exposure; it does not make weak passwords, stale firmware, or broad authorization acceptable.
Rank #2
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Use more than one network for HPC fabrics
NIST SP 800-223, published in February 2024, describes private, purpose-specific networks that limit which nodes can connect, simplify monitoring, and segment an HPC system. It says multiple physical networks are highly recommended for access control and fault tolerance. Map management, user-facing services, storage, provisioning, high-performance interconnects, and monitoring to the networks they actually need. Where physical separation is not feasible, use equivalent logical segmentation and explicit policy enforcement, while recognizing that a shared physical path can increase the blast radius of a mistake.
Free tools Windows power users keep installed
One-click scans. No signup required.
3. Harden administrator authentication
Require individual, least-privilege accounts
Do not administer a GPU host through a shared account. Give each administrator a named identity, grant only the required role, and remove accounts when people or vendors no longer need access. Review group membership, sudo or equivalent privilege, service accounts, and emergency credentials on a schedule that matches the system’s risk. Store break-glass credentials separately, monitor their use, and test recovery without leaving them permanently privileged.
Prefer phishing-resistant MFA
Require multi-factor authentication wherever the identity provider and access path support it. CISA gives a phishing-resistant secondary verification method, such as hardware-based PKI or FIDO authentication, as an example. Phishing-resistant MFA is particularly valuable for VPN, bastion, cloud-control, and privileged shell access because stealing a password alone is not enough to complete the login.
Confirm compatibility among the server or gateway, identity provider, administrator workstation, and remote-access method before selecting a key or certificate format. Public-key authentication for administrative roles can reduce password dependence, but keys still require lifecycle controls: enrollment approval, protected storage, rotation or replacement, revocation, and logging. A hardware security key can support this design; it does not replace network segmentation, patching, or service minimization.
Control non-human identities
Inventory scheduler, monitoring, backup, container-registry, and automation credentials separately from human accounts. Give each service its own identity, limit its network reach, avoid embedding long-lived secrets in images or scripts, and rotate credentials through the supported mechanism. Alert on interactive use of service accounts and on authentication from an unexpected network.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
4. Patch the complete GPU platform stack
Define the patch inventory
Include the operating system, kernel, BMC and platform firmware, GPU firmware where applicable, GPU drivers, CUDA or equivalent runtime components, management tools, container runtime, orchestrator, scheduler, monitoring agents, and every Internet- or user-reachable service. A driver update that leaves an exposed management daemon or vulnerable kernel unchanged is not a complete security update.
Rank #3
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
- Classify assets by exposure, privilege, and business impact.
- Subscribe to the platform vendor’s security advisories and record affected versions, mitigations, and fixed versions.
- Test updates on a representative node or maintenance partition before broad rollout.
- Define a maintenance window, rollback image or package set, health checks, and an owner who can stop the change.
- Verify after reboot that the driver, GPU visibility, fabric, scheduler, storage, monitoring, and authentication all work as intended.
Use authoritative advisory channels
CISA recommends keeping systems and software current and automating updates where feasible with vendor-provided updates. NVIDIA directs customers to its security bulletins for driver and software-package updates and offers bulletin notifications. NVIDIA announced that, from October 1, 2026, its PSIRT would publish bulletins on GitHub in Markdown, CSAF, and CVE formats while continuing to make bulletins available through its product-security website. That publication arrangement is time-sensitive; verify the current process when you build your notification procedure.
Prioritize components reachable from less-trusted networks and vulnerabilities that allow code execution, authentication bypass, or privilege escalation. Record exceptions with an expiry date and compensating controls; “cannot patch” is not a permanent status.
5. Control network access and egress
Separate traffic by purpose
At minimum, evaluate separate policy zones for management, user-facing services, storage, and high-performance compute traffic. Permit only the flows required by the workload. Restrict inbound administration to approved bastions, VPN pools, or management subnets. Keep cluster and storage interfaces off public routes unless the architecture explicitly requires otherwise.
Decide whether the host needs Internet egress
Many compute nodes need only approved repositories, registries, time services, telemetry endpoints, or license systems. If a node does not need general Internet access, deny it by default and allow named destinations through a proxy or controlled gateway. NIST notes that proxies and NAT can enable software downloads or sharing but also introduce security risks that require mitigation. Log denied and permitted egress so unexpected outbound connections become an actionable signal.
Review rules continuously
Require peer review for firewall changes, attach an owner and expiration date to temporary rules, and compare configuration with the live boundary on a recurring schedule. Re-scan after driver, container, orchestration, or application changes because a new service can open a listener without changing the network diagram. Alert on listeners appearing on all interfaces, management services exposed to user networks, and rules that broaden a source range.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.6. Add controls for shared GPU and HPC nodes
Sanitize between jobs or tenants
On a multi-tenant node, treat job-to-job sanitization as a security control, not merely housekeeping. NIST SP 800-223 lists measures such as an end-of-job health check, removing or rebooting unhealthy nodes, working with vendors on GPU sanitization hooks, resetting GPUs to remove residual data, validating firmware, rebooting the operating system, and checking critical files.
Rank #4
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- USB TYPE C Connectivity & DONGLE Design: Designed for PCs, Macs, laptops, iPhones, and Android devices that utilize a USB-C port. Plug and stay, or carry it on a keychain. (Item Size: 0.73 x 0.60 x 0.30 inches)
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC functionality is not supported.
Choose the sequence and depth that fit the accelerator, driver, scheduler, and performance target. Sanitization can reduce utilization, so document which checks run after every job, which run when a node is quarantined, and who can release a node back to the pool. A failed health or sanitization check should quarantine the node rather than silently returning it to service.
Separate workloads and administrative paths
Use scheduler and container controls to prevent jobs from reaching BMC interfaces, host management sockets, other tenants’ storage, or unrestricted metadata and control services. Apply network policies at the node, pod, or fabric layer as supported. Do not assume that a container boundary alone protects a shared accelerator; combine workload isolation with least-privilege identities, kernel and driver updates, and monitoring.
Distinguish routine sanitization from retirement
NVIDIA’s DGX guides describe secure SSD deletion procedures for system retirement or data-destruction requirements. Those procedures address a different lifecycle event and are not substitutes for routine patching, access control, workload isolation, or between-job GPU and node checks.
7. Run a recurring validation cycle
- Reconcile inventory: compare approved services, interfaces, accounts, firmware, drivers, and software with the running system.
- Scan boundaries: test external, user, management, storage, and cluster perspectives and investigate every unapproved listener.
- Review identity: remove stale accounts and keys, verify MFA enforcement, and inspect privileged and service-account use.
- Check patch state: compare versions with current operating-system, platform, and vendor advisories; document exceptions and deadlines.
- Test segmentation: confirm that user networks cannot reach BMC or restricted management services and that compute nodes have only approved egress.
- Exercise recovery: verify that a node can be isolated, reimaged or rolled back, sanitized, and returned to the scheduler with trustworthy health evidence.
- Record evidence: retain scan results, firewall reviews, access reviews, patch approvals, failed checks, and remediation owners.
Increase the frequency after major topology, firmware, driver, orchestration, or workload changes. A checklist that is never reconciled with live configuration becomes a description of the past rather than a control.
Choosing between GPU-server configurations
When comparing deployment options, score the architecture against the same security questions rather than comparing product names. The relevant axes are:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →| Decision axis | Questions to answer | Evidence to retain |
|---|---|---|
| Workload role and flows | What must connect, from where, and for what purpose? | Approved service and data-flow inventory |
| Out-of-band management | Is there a dedicated BMC network, and who can reach it? | Network diagram, firewall policy, access logs |
| Segmentation | Are management, users, storage, and HPC fabrics separated? | Zone definitions and denied-flow tests |
| Tenant model | Is the node single-tenant or shared, and what sanitization occurs? | Scheduler hooks, health checks, quarantine records |
| Identity capability | Can the access path enforce individual accounts and phishing-resistant MFA? | Identity-provider policy and authentication logs |
| Vendor responsiveness | How are firmware, driver, and software advisories delivered and applied? | Subscriptions, change records, test and rollback results |
Common failure modes and corrective actions
- “The GPU server only needs one port.” Corrective action: inventory all role dependencies and approve flows by source, destination, and purpose; do not infer a universal allowlist.
- BMC reachable from an office or public VLAN. Corrective action: move it to a dedicated, firewall-protected management network and require an isolated remote-access path.
- A shared administrator password survives a migration. Corrective action: create named accounts, enforce MFA, rotate credentials, and review privilege immediately.
- Drivers are current but firmware and management tools are not. Corrective action: patch the complete stack against operating-system and vendor advisories, with testing and rollback.
- Temporary firewall or egress exceptions never expire. Corrective action: attach an owner and deadline, log use, and remove the rule when the task ends.
- A tenant’s job can access a previous tenant’s GPU state or host socket. Corrective action: implement supported reset and sanitization hooks, quarantine failed nodes, and test isolation from the job environment.
Operational acceptance criteria
Before placing a GPU server into production, require written evidence that every listener has an owner and approved purpose; management interfaces are isolated; administrator identities are individual, least-privileged, and protected by strong MFA; the operating system, firmware, drivers, and services have a maintained update path; network zones and egress rules have been tested; and shared nodes perform documented health and sanitization checks. Re-run those tests after material changes and preserve the results for the next review.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
