Password + authenticator code required.
First time? Open setup_2fa.php to add the app to Google Authenticator, then delete that file.