Why does this mysterious login page suddenly appear whenever I try to access my services? reddit / selfhosted ---------------------------------------------------------------------- WassiChain · 2023-10-23 17:32 I use Duck DNS and Caddy for reverse-proxy. My server runs on an old laptop with Debian and everything is on Docker. I also use Tailscale. I didn't login using any my credentials or anything yet, have I been hacked? It seems to be some type of 2 factor authentication login but I never set anything like that up (and I'm the only one that uses the server). Any help would be appreciated, thanks. https://preview.redd.it/k8wp4svjmzvb1.jpg?width=1905&format=pjpg&auto= webp&s=c76a891bd0540268ac11cd6e255eb5f960cc74f4 ---------------------------------------------------------------------- flaming_m0e · 2023-10-23 17:41 That's a Fortinet login page for Security Fabric. https://www.fortinet.com/solutions/enterprise-midsize- business/security-fabric Sounds like you're hitting a login page for someone else's domain, or there are some Fortinet devices somewhere in the middle. This thing has nothing to do with your Caddy ---------------------------------------------------------------------- WassiChain · 2023-10-23 17:49 I thought my duckdns subdomain was unique to me, how is it even possible for me to be reaching someone elses domain? ---------------------------------------------------------------------- flaming_m0e · 2023-10-23 17:50 Do you have control over your router? Did you forward ports? Did you actually register YOUR public IP to DuckDNS? Did you register the wrong IP to DuckDNS? So many details missing, but rest assured, you aren't hacked. ---------------------------------------------------------------------- WassiChain · 2023-10-23 18:06 Just fixed it. Seems like my public IP changed which the duckdns ip updater container I have running should've caught but for some reason it didn't work. I manually fixed the IP with duckdns and everything is working. Thanks for answering my stupid questions lmao ---------------------------------------------------------------------- buneech · 2023-10-23 18:06 Did your ip change and duckdns didn't update? You're probably getting someone else's services, if they got your previous ip. ---------------------------------------------------------------------- WassiChain · 2023-10-23 18:07 Yeah that's exactly what happened. I manually updated the ip and everything is working now! ---------------------------------------------------------------------- ethereal_g · 2023-10-23 18:19 Someone’s fortigate has a management interface exposed to the internet.. good luck to them. ---------------------------------------------------------------------- EndlessHiway · 2023-10-23 18:49 Wasn't a stupid question. ---------------------------------------------------------------------- thekrautboy · 2023-10-23 19:13 Every now and then there are stories of DuckDNS being a bit unreliable at times, but its free so cant really complain about that. You might want to consider running two ddns-updater tools at the same time, for example your router updates it and then you have ddclient as container also running. If either of them messes up somehow, its very likely the other one still updates so you wont have this exact situation anymore. Of course that doesnt help when the issue is DuckDNS itself. Depending on what you are doing with your (sub)domain, you can use another provider as fallback, for example afraid.org or dedyn.io And if your main domain with DuckDNS is acting weird again in the future, just try reaching it through the other one and you quickly can rule out a possible issue. ---------------------------------------------------------------------- WassiChain · 2023-10-23 20:50 What is Fortigate? A firewall? ---------------------------------------------------------------------- TackOverflow · 2023-10-23 21:23 That's what I was thinking. Someone's publicly exposed fortigate device was probably hacked months ago via one of the CVEs. ---------------------------------------------------------------------- odsquad64 · 2023-10-23 21:27 I've had some weird stuff happen with duckdns ---------------------------------------------------------------------- flaming_m0e · 2023-10-23 21:45 Yes ---------------------------------------------------------------------- I_Arman · 2023-10-23 21:56 No question you can learn from is a stupid question. ---------------------------------------------------------------------- machstem · 2023-10-23 22:21 With the number of CVE against that exact thing, yes, good luck to them. Firewall and VPN vendors were hit hard during lockdown and still today ---------------------------------------------------------------------- Windows_XP2 · 2023-10-23 22:51 I wouldn't consider your question stupid. You had a problem with a stupid simple solution. Happens to the best of us. ---------------------------------------------------------------------- zifzif · 2023-10-23 23:05 I like this option the best. There are stupid questions. This wasn't one of them. ---------------------------------------------------------------------- JVAV00 · 2023-10-24 06:39 Isn't this a fortinet firewall, I've used this in my class to learn about it ---------------------------------------------------------------------- Cybasura · 2023-10-24 08:12 I wish I had stupid simple problems