Hardening a DGX Station GB300 means treating it as a Linux server that happens to sit by a desk. Lock down the BMC first, keep Secure Boot and the TPM on, and decide on disk encryption before sensitive data arrives. Patch on a schedule, apply a CIS baseline, restrict accounts and close every network port you don't need, including the model API. The difficulty is that NVIDIA publishes no security guide, BMC hardening guide or encryption procedure for the GB300 Station. Its DGX OS 7 security material is written for DGX servers. The checklist below therefore combines NVIDIA's Station software stack page, OEM specifications, Canonical's Ubuntu tooling and the Cyber Security Agency of Singapore's (CSA) Cyber Essentials and agentic-AI guidance. It records what each source says as of 9 Nov 2026. It is a starting point for your own security review, not a certification. SourceIT has not audited a unit.
What belongs on a DGX Station GB300 hardening checklist?
| Control | Why it matters | What to do | Evidence for audit |
|---|---|---|---|
| BMC credentials and network | Full remote control of the hardware | Change the password at first login; put the 1 GbE BMC port on a management network | Changed-password record, VLAN or switch-port assignment |
| Secure Boot and TPM | Blocks unsigned boot code; supports attestation | Confirm both are on (NVIDIA default: ON) | Firmware setup screenshot |
| Disk encryption | Protects data on a returned or stolen drive | Choose self-encrypting drives where offered, or your own scheme, before data lands | Drive model and encryption setting |
| Firmware updates | Fixes BMC and UEFI flaws | Use the OEM's update process (Redfish UpdateService, UEFI capsules) | Firmware versions vs OEM current list |
| OS patching | Closes known vulnerabilities | Apply critical updates "as soon as feasible" (CSA) in a planned window | Patch log |
| CIS baseline | Removes insecure defaults | Run Canonical's Ubuntu Security Guide (needs Ubuntu Pro) | USG audit report |
| Accounts and admin access | Limits damage from one stolen login | Least privilege, MFA for admins, remove accounts inactive over 60 days | Quarterly account review |
| Network exposure | Model APIs often start with no authentication | Firewall all but required ports; put an API key or SSH tunnel in front of vLLM | Port scan, firewall rules |
| AI agents and code | Agents can run commands and reach the internet | Sandbox agents, no sudo by default, allow-list outbound traffic, log to a SIEM | Sandbox policy, log forwarding |
Source: NVIDIA DGX Station Development Guide, software stack page (updated 30 Oct 2026); Dell Pro Max with GB300 setup manual and specifications (en-sg, 22 Sep 2026); Supermicro ARS-511GD-NB-LCC product page; Canonical, "Hardening automation for CIS benchmarks now available for Ubuntu 24.04 LTS" (20 Mar 2025); CSA Cyber Essentials (Mar 2025) provisions A.5.4 and A.7.4; CSA Securing Agentic AI Addendum (17 Jun 2026). All fetched or confirmed 9 Nov 2026.
How do you lock down the BMC?
The BMC is a small computer inside the Station with its own 1 GbE port. NVIDIA describes it as giving "secure out-of-band remote management" through a web UI and Redfish. Anyone who reaches it can power-cycle the machine, mount virtual media and update firmware, so it is the first thing to secure. Dell's units run a MegaRAC OneTree interface and force a password change at first login. Default credentials for other OEMs are not published; get them from your supplier and change them at handover. Reports also differ on which BMC stack MSI uses, so confirm the details for your model.
Keep the BMC port off the general office LAN. A small managed switch or a dedicated management VLAN is enough for one or two Stations. NVIDIA says firmware is updated through a "secure firmware update workflow using the BMC and UEFI capsule updates through Redfish UpdateService", following the OEM's own process. Record the firmware versions at handover so you can tell when they fall behind.
Should Secure Boot stay on?
Yes, by default. NVIDIA's stack page lists "Secure boot and TPM (Trusted Platform Module) support" as "Default: ON", and describes support for UEFI Secure Boot and TPM-based attestation. OEM hardware adds to this. Dell lists a discrete TPM 2.0 with FIPS 140-2 and 140-3 certification. Supermicro lists TPM 2.0 and a silicon root of trust described as "NIST 800-193 Compliant". There is one trade-off to know about. NVIDIA's GPU Operator documentation says GPUDirect Storage "is not supported with secure boot". If you plan to use GPUDirect Storage for fast data loading, test it on your configuration before you promise it to users. Don't switch off Secure Boot to make it work without a security sign-off. Our NAS and high-speed storage guide covers the storage side.
What about disk encryption?
NVIDIA's Station documentation doesn't cover it. DGX OS 7 has a chapter on managing self-encrypting drives, but that is a DGX server document. Some HP and Dell configurations offer self-encrypting NVMe drives; the HP ZGX Fury G1n guide covers HP's options. Decide on encryption when you order, because changing it after data is on the drives is disruptive. Also plan for repairs. Dell's service manual lists the SSD as a field-replaceable unit, and Dell's Canada configurator offers a Keep Your Hard Drive option. Ask what happens to your drives if a unit has to be returned.
A model server that listens on every interface with no authentication is the easiest way into a well-patched Station. Close it, tunnel it or put a key on it before anyone else can reach it.
How should patching and the CIS baseline work?
The Station gets "repository-based over-the-air (OTA) updates" from OEM repositories, according to NVIDIA. No patch cadence is published for it. As a Singapore baseline, CSA's Cyber Essentials (A.7.4) says to apply critical updates "as soon as feasible". Updates that need a reboot also clear any MIG layout, because NVIDIA's MIG guide says MIG devices "are not persistent across system reboots". Schedule a maintenance window and re-apply the GPU layout afterwards.
For a CIS baseline, Canonical's Ubuntu Security Guide offers usg audit and usg fix with profiles such as cis_level1_server for Ubuntu 24.04. It needs an Ubuntu Pro subscription, which Dell includes with the Pro Max with GB300. Run the audit first, then review the proposed fixes and apply them in a maintenance window, checking afterwards that the GPU driver, containers and model servers still work.
Who should have access, and how?
CSA's Cyber Essentials (A.5.4) gives a workable baseline. Keep an inventory of accounts and grant least privilege. Remove accounts inactive for more than 60 days and lock accounts after about 10 failed attempts. Require MFA for administrative access and review access quarterly. NVIDIA publishes no directory or single-sign-on integration guide for the Station, so treat that as a project of your own. For remote use, NVIDIA Sync connects over SSH on the LAN or through Tailscale, and its documentation says bastion or jump hosts are not supported. Our post on shared remote access for departments covers the options.
Which ports and services should be open?
NVIDIA's DGX OS 7 connectivity appendix is a useful reference, though it is written for DGX servers. It lists 22/TCP inbound for SSH, 53/UDP outbound for DNS, 80/TCP outbound for package updates, 111/TCP for NFS and 443/TCP outbound to NGC. If 443 is proxied, it notes, "WebSocket protocol traffic must be supported". Out-of-band, it lists 443/TCP for the BMC web interface and 623/UDP for IPMI. Then add the model servers. NVIDIA's own vLLM playbook starts a server that listens on all interfaces without authentication. Give it an API key, keep it behind an SSH tunnel or firewall it before anyone else can reach it. Whether to connect the Station to the internet at all is covered in air-gapped vs connected AI workstations.
How do you contain AI agents?
Coding and automation agents can run commands, so treat them as untrusted code. NVIDIA's "Secure AI Agents with OpenShell" playbook isolates agents "using kernel-level policies", and it is the only security playbook on the Station hub. CSA's Securing Agentic AI Addendum (17 Jun 2026) recommends least privilege with no sudo by default, sandboxing AI-generated code, outbound allow-lists and logging to a SIEM. The application-level risks, such as prompt injection and over-broad connectors, are covered in why your AI assistant could be the biggest security risk. Ownership of all this sits with the team in who manages a DGX Station. Regulated firms can map these controls onto sector rules in our financial services private AI post.
Buying in Singapore
For a separate management network, the HPE Aruba CX 6100 24-port managed switch is S$1,941.60. For controlled outbound access, the FortiGate 70G is S$1,668.00 and the FortiGate 90G is S$3,796.80 (listed 9 Nov 2026). Check whether a security subscription is included before you compare quotes. Prices change; ask for a current quotation. Our six DGX Station GB300 listings, including the HP ZGX Fury G1n and Dell Pro Max with GB300, are price on request. We can confirm drive-encryption and TPM options with the OEM when we validate your configuration. Use Request for Quotation on the product page, call (65) 6978 3502, email Sales@sourceit.com.sg or use our contact page.
Frequently asked questions
Does NVIDIA publish a security guide for the DGX Station GB300? Not as of 9 Nov 2026. NVIDIA's DGX OS 7 security material covers DGX servers. For the Station, combine NVIDIA's stack page, the OEM manual and standard Ubuntu hardening.
Is Secure Boot on by default? Yes. NVIDIA lists Secure Boot and TPM support as "Default: ON". Note that NVIDIA's GPU Operator docs say GPUDirect Storage is not supported with secure boot.
How do I apply a CIS benchmark? Canonical's Ubuntu Security Guide offers audit and fix commands with CIS profiles for Ubuntu 24.04. It requires Ubuntu Pro, which Dell includes with its GB300 model.
What is the biggest quick win? Change the BMC password, move the BMC to a management network and put authentication in front of any model server. Those three close the most direct routes in.
Does a reboot affect security settings? Not the security settings, but it clears MIG partitions. Plan patch windows so GPU layouts are re-applied afterwards.
SourceIT Approved
Researched and verified by the SourceIT team for Singapore buyers.
