Impostor

Before you start

Before you deploy this image, plan for the following:

• Recommended VM size: Standard_B2s (2 vCPU / 4 GiB). The server used about 30 MB of memory while accepting connections on this image.
• Game port: 22023, UDP and TCP. UDP carries the game traffic, and TCP is the HTTP matchmaker. Both must be reachable.
• SSH: port 22, restricted to your own address.
• Admin credential: none exists. Impostor has no admin login or server password (see Security posture).

Network security group

Among Us uses one port number for two protocols. The modern client speaks HTTP (TCP) to the matchmaker first, then plays over UDP. Opening only one of the two is the single most common cause of "the server shows up but nobody can join". Create both rules:

az network nsg rule create --resource-group <your-rg> --nsg-name <your-nsg> \
  --name impostor-game-udp --priority 1010 \
  --access Allow --protocol Udp --direction Inbound \
  --source-address-prefixes Internet --destination-port-ranges 22023
az network nsg rule create --resource-group <your-rg> --nsg-name <your-nsg> \
  --name impostor-matchmaker-tcp --priority 1011 \
  --access Allow --protocol Tcp --direction Inbound \
  --source-address-prefixes Internet --destination-port-ranges 22023

Run those commands from your workstation with your own resource names. Do not open anything else. SSH on 22 (restricted to your own address) and the game port are the only listeners this image exposes.

First boot

On first boot, the VM resolves its own public IP address and writes it into the server configuration before the server is allowed to start. This matters more than it sounds. The HTTP matchmaker returns that configured address to every joining player as the game server endpoint, so a wrong or loopback value makes every lobby join fail even though the ports are open.

The service is gated on a marker that the first-boot process writes only after the address is in place, so the server can never come up advertising a stale address.

Give the VM a minute after it reports Running, then check both units:

systemctl is-active impostor-firstboot.service impostor.service

Both report active. Then read this VM's connection note:

sudo cat /root/impostor-server-info.txt

Expected output (your addresses will differ):

IMPOSTOR_PUBLIC_IP=20.106.160.134 IMPOSTOR_GAME_PORT=22023 IMPOSTOR_SERVER_URL=http://20.106.160.134:22023/ NOTE=UDP 22023 carries the game traffic; TCP 22023 is the HTTP matchmaker. Open both. NOTE2=Lobbies live in memory only — restarting the service ends all running games.

IMPOSTOR_PUBLIC_IP and IMPOSTOR_GAME_PORT are exactly what you hand to your players. The same summary is shown on every SSH login.

Connecting from the game

Your players need nothing from this guide except an address and a one-time region file import.

• Generate a region file at the official generator: https://impostor.github.io/Impostor. Enter your VM's IMPOSTOR_PUBLIC_IP value as the server address, port 22023, and any name you like for the region.
• Each player downloads that file and opens it with Among Us installed. The game imports it, and a new region appears in the region menu (bottom right of the game's main screen).
• Players select your region, then create and join lobbies exactly as they would on the official servers.

Version compatibility. The server accepts the game versions supported by Impostor v1.10.6 (game builds from 2024.6.18 through 17.3.1). The shipped configuration keeps AllowFutureGameVersions off, so a brand-new game update may be refused until upstream ships a compatible server release. See Upgrading the server, and the compatibility settings in Tuning the server.

What actually happens when a player connects

The modern client connects in two steps, both to port 22023 on your VM:

• HTTP matchmaking (TCP). The client requests a matchmaking token from POST /api/user and uses it to create or find a lobby via /api/games. The matchmaker answers with the game endpoint, which is the public address resolved at first boot.
• Game transport (UDP). The client performs the game protocol handshake over UDP and joins the lobby.

To see the matchmaker's front page yourself, run this on the VM:

curl -s http://127.0.0.1:22023/

Expected output:

Impostor is running, please configure your Among Us to connect to a game To generate a region file, go to https://impostor.github.io/Impostor

Verifying your deployment

The image carries its own end-to-end check. It does not settle for "a port is open". It walks the same flow a real game client walks:

sudo /usr/local/sbin/impostor-selftest

Expected output:

OK hello page served, matchmaking token issued+verified (impostor_was_here), hazel UDP handshake acknowledged on 22023

That one line proves three things, in order.

• The hello page on the HTTP matchmaker answers with Impostor's own banner.
• Token issuance works. A real POST /api/user request returns a matchmaking token whose payload decodes to the server-signed impostor_was_here hash, the exact token a client must present.
• The game protocol accepts connections. A fully formed Hazel HELLO handshake packet, carrying a supported client version and platform data, is sent to 22023/udp. The server acknowledges it and registers the probe as a connected client. The server's own log records the probe connecting and disconnecting like any other player.

The protocol probe is also available on its own, and it reports exactly what the server did:

sudo /usr/local/bin/impostor-udp-probe --host 127.0.0.1 --port 22023

Expected output:

ACK hazel handshake acknowledged and client registered by 127.0.0.1:22023/udp (opcode 0x0a, nonce 1 echoed, client version 2026.2.2 accepted)

If a check fails, the probe prints what it received instead. See Troubleshooting.

Managing the service

Check the service status:

systemctl status impostor.service --no-pager

The server logs to the systemd journal:

sudo journalctl -u impostor.service --no-pager | tail -20

A healthy start looks like this in the journal:

[21:24:01 INF] Starting Impostor v1.10.6+06f4f8bf00cab403d9570aff582fbf01ca4dd8cc [21:24:01 INF] Matchmaker is listening on 0.0.0.0:22023, the public server ip is 20.106.160.134:22023. [21:24:01 INF] Loading plugins. [21:24:01 INF] Loaded 0 plugins. [21:24:02 INF] Now listening on: http://0.0.0.0:22023 [21:24:02 INF] Application started. Press Ctrl+C to shut down.

Restarting is safe at any time, with one caveat. Lobbies live in memory only, so a restart ends every running game.

sudo systemctl restart impostor.service

The listener surface is deliberately minimal: the game port on both protocols, and SSH. Confirm it with:

ss -tln | grep -E ':(22|22023) '
ss -uln | grep ':22023 '

Tuning the server

Configuration is one JSON file. View it with:

sudo cat /etc/impostor/config.json

The shipped settings, and why:

• Server.PublicIp: resolved at first boot. This is the address the matchmaker hands to joining players. It is managed for you, so do not set it to a loopback or private address.
• Server.PublicPort / ListenPort: 22023. This is the standard game port, UDP.
• HttpServer.Enabled: true. This is the HTTP matchmaker the modern client requires, TCP 22023.
• AntiCheat.Enabled: true. All anticheat checks are on, and offending IPs are banned from the game (BanIpFromGame).
• AntiCheat.ForbidProtocolExtensions: true. This rejects nonstandard protocol extensions.
• Compatibility.AllowFutureGameVersions: false. This refuses game builds newer than this server knows. Turning it on lets a brand-new client connect, at your own risk, until an upstream server update ships.
• Debug.GameRecorderEnabled: false. The debug game recorder stays off.

To change a setting, edit the file and restart:

sudoedit /etc/impostor/config.json
sudo systemctl restart impostor.service

The pristine upstream defaults are kept at /usr/share/doc/impostor/config.json.default for reference.

Plugins

Impostor has a first-class plugin API (Impostor.Api on NuGet) with a community of published plugins, including game modes, roles and lobby announcements.

The service's working directory is /var/lib/impostor, so:

• Plugin DLLs go into /var/lib/impostor/plugins/
• Their dependency DLLs go into /var/lib/impostor/libraries/

sudo cp MyPlugin.dll /var/lib/impostor/plugins/
sudo chown impostor:impostor /var/lib/impostor/plugins/MyPlugin.dll
sudo systemctl restart impostor.service

Copy a plugin in and restart as shown above. The journal then reports what loaded:

sudo journalctl -u impostor.service --no-pager | grep -i plugin | tail -3

A stock image reports Loaded 0 plugins., and nothing is hidden in there.

Upgrading the server

The .NET runtime underneath the server is the Ubuntu aspnetcore-runtime-8.0 package, so ordinary Ubuntu security updates keep the entire runtime stack current automatically. Nothing is pinned or held back.

The Impostor server binary itself is upstream's release artefact. When a new stable release ships, for example after a game update, upgrading is a tarball swap. Replace <version> with the new release:

curl -fsSL -o /tmp/impostor.tar.gz \
  https://github.com/Impostor/Impostor/releases/download/v<version>/Impostor-Server_<version>_linux-x64.tar.gz
sudo systemctl stop impostor.service cd /tmp && tar -xzf impostor.tar.gz Impostor.Server
sudo install -o root -g root -m 0755 /tmp/Impostor.Server /opt/impostor/Impostor.Server
sudo systemctl start impostor.service

Then confirm the new version in the journal, and re-run the self-test:

sudo journalctl -u impostor.service --no-pager | grep 'Starting Impostor' | tail -1 sudo /usr/local/sbin/impostor-selftest

Security posture

A game server is public by design. Players connect to it over the internet, and that is its entire purpose. Impostor has no admin login, no web console and no server password feature, so there is no credential for this image to generate or for you to rotate. Secure by default therefore means containment and honest configuration, and that is what ships:

• A dedicated account. The server runs as the impostor system user with no shell and no home login.
• A strict sandbox. The systemd unit applies NoNewPrivileges, ProtectSystem=strict, ProtectHome, PrivateTmp, an empty capability set and a read-write allowance for /var/lib/impostor only. The .NET diagnostics socket is disabled outright.
• Anticheat on, recorder off. Every anticheat check is enabled, and the debug game recorder is not.
• A minimal surface. Only TCP 22 and 22023 and UDP 22023 listen, and the build fails if anything else ever does.

The provenance record for the installed binary is in the README:

cat /usr/share/doc/impostor/README.sac

Recommendations:

• Restrict the SSH rule in your NSG to your own address. Only the two game port rules need Internet as a source.
• Give players the address from the connection note and nothing else, because there is nothing else to give.
• If you run a public community server, watch the journal for ban activity and consider a plugin for lobby moderation.

Server components

• Impostor server: version 1.10.6, installed at /opt/impostor/Impostor.Server.
• ASP.NET Core runtime: version 8.0 (Ubuntu package, updated automatically), installed at /usr/lib/dotnet.
• Configuration: /etc/impostor/config.json.
• Plugins and libraries: /var/lib/impostor/plugins and /var/lib/impostor/libraries.
• Self-test: /usr/local/sbin/impostor-selftest.
• Protocol probe: /usr/local/bin/impostor-udp-probe.
• Licence and source offer: GPL 3.0, in /usr/share/doc/impostor/.

Filesystem layout

Mount points:

• / (30 GB): root filesystem.
• /boot/efi (100 MB): UEFI boot partition (Gen2 Hyper-V).
• /mnt (size varies): Azure temporary resource disk.

Key directories:

• /opt/impostor: the server binary.
• /etc/impostor: configuration, symlinked into the working directory.
• /var/lib/impostor: working directory for plugins and libraries.
• /var/lib/sac: first-boot sentinel and bootstrap marker.

Troubleshooting

Players cannot join, but the server "shows up". This is almost always the NSG. Among Us needs both UDP 22023 and TCP 22023 open. The client's region list is served over TCP, but actual play needs UDP. Re-check both rules, then run the self-test on the VM. If it reports OK, the server side is proven, and the problem is network reachability from the player's side.

Players get "you are running an older/newer version". The client and server must speak compatible protocol versions. Check the supported range in Connecting from the game. After a game update, upgrade the server when upstream ships a release (see Upgrading the server), or as a stopgap enable Compatibility.AllowFutureGameVersions and restart.

The self-test fails on the UDP step. Read what the probe printed. no response with the HTTP checks passing usually means a local firewall was added that blocks UDP. A protocol DISCONNECT response means the server parsed the handshake and refused it. The journal says why:

sudo journalctl -u impostor.service --no-pager | tail -20

The service is not running. impostor.service is deliberately gated on first boot completing, so it will not start if the bootstrap marker is missing:

systemctl is-active impostor-firstboot.service impostor.service
sudo journalctl -u impostor-firstboot.service --no-pager | tail -20

The advertised address is wrong. The matchmaker hands players the Server.PublicIp value from the configuration. First boot manages it. If you have edited it by hand, put the VM's real public IP back (see the connection note) and restart the service.

Support

SecureAnyCloud images come with 24/7 support. Include the output of sudo /usr/local/sbin/impostor-selftest and the last lines of sudo journalctl -u impostor.service with any request.

• Email: sales@secureanycloud.com
• Response time: 24/7 with guaranteed 24 hour response SLA
• Website: https://secureanycloud.com

Impostor itself is community software. For plugin development and game protocol questions, the upstream project and its community are the right place.

Deploy on Azure

Launch Impostor Among Us Private Server v1.10.6 on Ubuntu 24.04 on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com