Issue: Random 2FA login screen appears whenever I try to access my services, I have not set up 2FA on my server. Still shows up even when I stop and remove Caddy container, maybe something went wrong on DuckDNS’s side?

Additional info: Server runs on Debian 12, I use DuckDNS and Caddy for reverse-proxy, and mainly use the server for Jellyfin, Nextcloud, Vaultwarden, and Komga all on Docker.

Have I been hacked? I stopped all the containers but should I also power off my machine? Any help would be appreciated, sorta panicking lol

https://preview.redd.it/k8wp4svjmzvb1.jpg?width=1905&format=pjpg&auto=webp&s=c76a891bd0540268ac11cd6e255eb5f960cc74f4

  • jonne@infosec.pub
    link
    fedilink
    English
    arrow-up
    2
    ·
    edit-2
    1 year ago

    Are you accessing it over DNS or through its IP address? Does it show for both?

    Edit: the security fabric login screen appears to be something from a Fortinet firewall. Do you have a hardware firewall?