diff --git a/cmd/commandfuncs.go b/cmd/commandfuncs.go
index a8247895..875fb5a9 100644
--- a/cmd/commandfuncs.go
+++ b/cmd/commandfuncs.go
@@ -148,6 +148,8 @@ func cmdStart(fl Flags) (int, error) {
 }
 
 func cmdRun(fl Flags) (int, error) {
+	caddy.TrapSignals()
+
 	runCmdConfigFlag := fl.String("config")
 	runCmdConfigAdapterFlag := fl.String("adapter")
 	runCmdResumeFlag := fl.Bool("resume")
diff --git a/cmd/main.go b/cmd/main.go
index 4fd8d681..00d5d138 100644
--- a/cmd/main.go
+++ b/cmd/main.go
@@ -51,8 +51,6 @@ func init() {
 // Main implements the main function of the caddy command.
 // Call this if Caddy is to be the main() if your program.
 func Main() {
-	caddy.TrapSignals()
-
 	switch len(os.Args) {
 	case 0:
 		fmt.Printf("[FATAL] no arguments provided by OS; args[0] must be command\n")
diff --git a/modules/caddyhttp/caddyauth/command.go b/modules/caddyhttp/caddyauth/command.go
index 2c088157..f3e1809d 100644
--- a/modules/caddyhttp/caddyauth/command.go
+++ b/modules/caddyhttp/caddyauth/command.go
@@ -21,6 +21,7 @@ import (
 	"flag"
 	"fmt"
 	"os"
+	"os/signal"
 
 	"github.com/caddyserver/caddy/v2"
 	caddycmd "github.com/caddyserver/caddy/v2/cmd"
@@ -67,17 +68,29 @@ func cmdHashPassword(fs caddycmd.Flags) (int, error) {
 	salt := []byte(fs.String("salt"))
 
 	if len(plaintext) == 0 {
-		if terminal.IsTerminal(int(os.Stdin.Fd())) {
-			fmt.Print("Enter password: ")
-			plaintext, err = terminal.ReadPassword(int(os.Stdin.Fd()))
-			fmt.Println()
+		fd := int(os.Stdin.Fd())
+		if terminal.IsTerminal(fd) {
+			// ensure the terminal state is restored on SIGINT
+			state, _ := terminal.GetState(fd)
+			c := make(chan os.Signal)
+			signal.Notify(c, os.Interrupt)
+			go func() {
+				<-c
+				_ = terminal.Restore(fd, state)
+				os.Exit(caddy.ExitCodeFailedStartup)
+			}()
+			defer signal.Stop(c)
+
+			fmt.Fprint(os.Stderr, "Enter password: ")
+			plaintext, err = terminal.ReadPassword(fd)
+			fmt.Fprintln(os.Stderr)
 			if err != nil {
 				return caddy.ExitCodeFailedStartup, err
 			}
 
-			fmt.Print("Confirm password: ")
-			confirmation, err := terminal.ReadPassword(int(os.Stdin.Fd()))
-			fmt.Println()
+			fmt.Fprint(os.Stderr, "Confirm password: ")
+			confirmation, err := terminal.ReadPassword(fd)
+			fmt.Fprintln(os.Stderr)
 			if err != nil {
 				return caddy.ExitCodeFailedStartup, err
 			}
diff --git a/modules/caddyhttp/fileserver/command.go b/modules/caddyhttp/fileserver/command.go
index 53aa7aa5..6a44b3ca 100644
--- a/modules/caddyhttp/fileserver/command.go
+++ b/modules/caddyhttp/fileserver/command.go
@@ -61,6 +61,8 @@ respond with a file listing.`,
 }
 
 func cmdFileServer(fs caddycmd.Flags) (int, error) {
+	caddy.TrapSignals()
+
 	domain := fs.String("domain")
 	root := fs.String("root")
 	listen := fs.String("listen")
diff --git a/modules/caddyhttp/reverseproxy/command.go b/modules/caddyhttp/reverseproxy/command.go
index 6de052e7..a5939a2a 100644
--- a/modules/caddyhttp/reverseproxy/command.go
+++ b/modules/caddyhttp/reverseproxy/command.go
@@ -66,6 +66,8 @@ default, all incoming headers are passed through unmodified.)
 }
 
 func cmdReverseProxy(fs caddycmd.Flags) (int, error) {
+	caddy.TrapSignals()
+
 	from := fs.String("from")
 	to := fs.String("to")
 	changeHost := fs.Bool("change-host-header")