Ia
Gaming Azure

Impostor Among Us Private Server v1.10.6 on Ubuntu 24.04 on Azure User Guide

| Product: Impostor Among Us Private Server v1.10.6 on Ubuntu 24.04 on Azure

Overview

This guide covers the deployment and use of Impostor v1.10.6 on Ubuntu 24.04 on Azure using cloudimg Azure Marketplace images.

Impostor is the standard open source private server for Among Us. Instead of playing over the official servers, you and your friends point your own game clients at a server you control: your own lobbies, your own rules, lower latency in the region you choose, and game traffic that never leaves infrastructure you own. Impostor reimplements the server side of the game protocol cleanly, supports current game clients, and can be extended through a first class plugin API.

This image ships the server only. Your players do not need it and never log into it. They install Among Us normally on their own machines — Steam, Epic, itch.io, mobile or console — and import a small region file that adds your server to the game's server list. The image bundles no game content and no Innersloth assets whatsoever.

What you get

Capability What it means in practice
Your own lobbies Games are created and joined on your VM exactly as on the official servers: host a lobby, share the code, play.
The full modern connection flow The 2022.12+ client connects in two steps — an HTTP matchmaking exchange that issues a token, then the UDP game transport. Both are preconfigured on the standard port 22023.
The address problem solved The matchmaker hands your VM's address back to every joining player. First boot resolves the real public IP into the configuration automatically — the step that silently breaks most self hosted servers.
Anticheat on The shipped configuration keeps every anticheat check enabled, bans offending IPs from the game, and forbids protocol extensions.
A contained service The server runs as a dedicated no shell account under a strict systemd sandbox. There is no admin login, no web console and no debug listener.
Plugins Drop Impostor plugin DLLs into a directory and restart — the plugin API is first class upstream.

Licence

Impostor is free software licensed under the GNU General Public License, version 3. That is upstream's licence, verified from the LICENSE file at tag v1.10.6 — not from a badge.

The image ships the obligations with the binary:

  • /usr/share/doc/impostor/LICENSE — the full GPL 3.0 text.
  • /usr/share/doc/impostor/README.cloudimg — the exact upstream tag, the artefact digest the installed binary came from, and the corresponding source location.

Among Us is a trademark of Innersloth LLC. Impostor is community software; cloudimg and Impostor are not affiliated with or endorsed by Innersloth. Players connect with their own legitimately purchased copies of the game.

Before you start

Item Value
Recommended VM size Standard_B2s (2 vCPU / 4 GiB) — the server used about 30 MB of memory while accepting connections on this image
Game port 22023, UDP and TCP — UDP carries the game traffic, TCP is the HTTP matchmaker. Both must be reachable
SSH 22, restricted to your own address
Admin credential None exists. Impostor has no admin login or server password — see Security posture

Network security group

Among Us uses one port number for two protocols. The modern client speaks HTTP (TCP) to the matchmaker first, then plays over UDP. Opening only one of the two is the single most common cause of "the server shows up but nobody can join":

az network nsg rule create --resource-group <your-rg> --nsg-name <your-nsg> \
  --name impostor-game-udp --priority 1010 \
  --access Allow --protocol Udp --direction Inbound \
  --source-address-prefixes Internet --destination-port-ranges 22023

az network nsg rule create --resource-group <your-rg> --nsg-name <your-nsg> \
  --name impostor-matchmaker-tcp --priority 1011 \
  --access Allow --protocol Tcp --direction Inbound \
  --source-address-prefixes Internet --destination-port-ranges 22023

Run those from your workstation with your own resource names. Do not open anything else — SSH on 22 (restricted to your own address) and the game port are the only listeners this image exposes.

First boot

On first boot the VM resolves its own public IP address and writes it into the server configuration before the server is allowed to start. This matters more than it sounds: the HTTP matchmaker returns that configured address to every joining player as the game server endpoint, so a wrong or loopback value makes every lobby join fail even though the ports are open. The service is gated on a marker the first boot process writes only after the address is in place — the server can never come up advertising a stale address.

Give the VM a minute after it reports Running, then check both units:

systemctl is-active impostor-firstboot.service impostor.service

Both should report active. Then read this VM's connection note:

sudo cat /root/impostor-server-info.txt

Expected output (your addresses will differ):

IMPOSTOR_PUBLIC_IP=20.106.160.134
IMPOSTOR_GAME_PORT=22023
IMPOSTOR_SERVER_URL=http://20.106.160.134:22023/
NOTE=UDP 22023 carries the game traffic; TCP 22023 is the HTTP matchmaker. Open both.
NOTE2=Lobbies live in memory only — restarting the service ends all running games.

IMPOSTOR_PUBLIC_IP and IMPOSTOR_GAME_PORT are exactly what you hand to your players. The same summary is shown on every SSH login.

Terminal showing impostor-firstboot.service and impostor.service both active, the systemd status for the running Impostor server started as the dedicated impostor user, and the per VM connection note listing the resolved public IP, the game port 22023 and the note that UDP carries game traffic while TCP is the HTTP matchmaker

Connecting from the game

Your players need nothing from this guide except an address and a one time region file import.

  1. Generate a region file at the official generator: https://impostor.github.io/Impostor. Enter your VM's IMPOSTOR_PUBLIC_IP value as the server address, port 22023, and any name you like for the region.
  2. Each player downloads that file and opens it with Among Us installed — the game imports it and a new region appears in the region menu (bottom right of the game's main screen).
  3. Players select your region, then create and join lobbies exactly as they would on the official servers.

Version compatibility. The server accepts the game versions supported by Impostor v1.10.6 (game builds from 2024.6.18 through 17.3.1). The shipped configuration keeps AllowFutureGameVersions off, so a brand new game update may be refused until upstream ships a compatible server release — see Upgrading the server and the compatibility knobs in Tuning the server.

What actually happens when a player connects

The modern client connects in two steps, both to port 22023 on your VM:

  1. HTTP matchmaking (TCP). The client requests a matchmaking token from POST /api/user and uses it to create or find a lobby via /api/games. The matchmaker answers with the game endpoint — the public address resolved at first boot.
  2. Game transport (UDP). The client performs the game protocol handshake over UDP and joins the lobby.

You can see the matchmaker's front page yourself from the VM:

curl -s http://127.0.0.1:22023/

Expected output:

Impostor is running, please configure your Among Us to connect to a game
To generate a region file, go to https://impostor.github.io/Impostor

Verifying your deployment

The image carries its own end to end check. It does not settle for "a port is open" — it walks the same flow a real game client walks:

sudo /usr/local/sbin/impostor-selftest

Expected output:

OK hello page served, matchmaking token issued+verified (impostor_was_here), hazel UDP handshake acknowledged on 22023

That one line proves three things, in order:

  • The hello page on the HTTP matchmaker answers with Impostor's own banner.
  • Token issuance works: a real POST /api/user request returns a matchmaking token whose payload decodes to the server signed impostor_was_here hash — the exact token a client must present.
  • The game protocol accepts connections: a fully formed Hazel HELLO handshake packet, carrying a supported client version and platform data, is sent to 22023/udp and the server acknowledges it and registers the probe as a connected client. The server's own log records the probe connecting and disconnecting like any other player.

The protocol probe is also available on its own, and reports exactly what the server did:

sudo /usr/local/bin/impostor-udp-probe --host 127.0.0.1 --port 22023

Expected output:

ACK hazel handshake acknowledged and client registered by 127.0.0.1:22023/udp (opcode 0x0a, nonce 1 echoed, client version 2026.2.2 accepted)

Terminal showing the impostor selftest reporting OK with the hello page served, a matchmaking token issued and verified against the impostor_was_here server hash, and the hazel UDP handshake acknowledged, followed by the standalone UDP probe reporting the handshake acknowledged and the client registered with the echoed nonce and the accepted client version

If a check fails, the probe prints what it received instead — see Troubleshooting.

Managing the service

systemctl status impostor.service --no-pager

The server logs to the systemd journal:

sudo journalctl -u impostor.service --no-pager | tail -20

A healthy start looks like this:

[21:24:01 INF] Starting Impostor v1.10.6+06f4f8bf00cab403d9570aff582fbf01ca4dd8cc
[21:24:01 INF] Matchmaker is listening on 0.0.0.0:22023, the public server ip is 20.106.160.134:22023.
[21:24:01 INF] Loading plugins.
[21:24:01 INF] Loaded 0 plugins.
[21:24:02 INF] Now listening on: http://0.0.0.0:22023
[21:24:02 INF] Application started. Press Ctrl+C to shut down.

Restarting is safe at any time, with one caveat: lobbies live in memory only, so a restart ends every running game.

sudo systemctl restart impostor.service

The listener surface is deliberately minimal — the game port on both protocols, and SSH:

ss -tln | grep -E ':(22|22023) '
ss -uln | grep ':22023 '

Terminal showing the running server journal with Impostor v1.10.6 starting, the matchmaker listening on all addresses with the resolved public server IP, plugins loading and the HTTP server reachable, and the listener audit showing TCP 22 and 22023 plus UDP 22023 as the only exposed ports

Tuning the server

Configuration is one JSON file:

sudo cat /etc/impostor/config.json

The shipped settings, and why:

Setting This image Meaning
Server.PublicIp resolved at first boot The address the matchmaker hands to joining players. Managed for you — do not set it to a loopback or private address.
Server.PublicPort / ListenPort 22023 The standard game port, UDP.
HttpServer.Enabled true The HTTP matchmaker the modern client requires, TCP 22023.
AntiCheat.Enabled true All anticheat checks on; offending IPs are banned from the game (BanIpFromGame).
AntiCheat.ForbidProtocolExtensions true Rejects nonstandard protocol extensions.
Compatibility.AllowFutureGameVersions false Refuse game builds newer than this server knows. Turning it on lets a brand new client connect, at your own risk, until an upstream server update ships.
Debug.GameRecorderEnabled false The debug game recorder stays off.

To change something, edit the file and restart:

sudoedit /etc/impostor/config.json
sudo systemctl restart impostor.service

The pristine upstream defaults are kept at /usr/share/doc/impostor/config.json.default for reference.

Plugins

Impostor has a first class plugin API (Impostor.Api on NuGet) with a community of published plugins — game modes, roles, lobby announcements and more.

The service's working directory is /var/lib/impostor, so:

  • Plugin DLLs go into /var/lib/impostor/plugins/
  • Their dependency DLLs go into /var/lib/impostor/libraries/
sudo cp MyPlugin.dll /var/lib/impostor/plugins/
sudo chown impostor:impostor /var/lib/impostor/plugins/MyPlugin.dll
sudo systemctl restart impostor.service

The journal reports what loaded:

sudo journalctl -u impostor.service --no-pager | grep -i plugin | tail -3

A stock image reports Loaded 0 plugins. — nothing is hidden in there.

Upgrading the server

The .NET runtime underneath the server is the Ubuntu aspnetcore-runtime-8.0 package, so ordinary Ubuntu security updates keep the entire runtime stack current automatically — nothing is pinned or held back.

The Impostor server binary itself is upstream's release artefact. When a new stable release ships (for example after a game update), upgrading is a tarball swap — replace <version> with the new release:

curl -fsSL -o /tmp/impostor.tar.gz \
  https://github.com/Impostor/Impostor/releases/download/v<version>/Impostor-Server_<version>_linux-x64.tar.gz
sudo systemctl stop impostor.service
cd /tmp && tar -xzf impostor.tar.gz Impostor.Server
sudo install -o root -g root -m 0755 /tmp/Impostor.Server /opt/impostor/Impostor.Server
sudo systemctl start impostor.service

Then confirm the new version in the journal and re-run the self test:

sudo journalctl -u impostor.service --no-pager | grep 'Starting Impostor' | tail -1
sudo /usr/local/sbin/impostor-selftest

Security posture

A game server is public by design — players connect to it over the internet; that is its entire purpose. Impostor has no admin login, no web console and no server password feature, so there is no credential for this image to generate or for you to rotate. Secure by default therefore means containment and honest configuration, and that is what ships:

  • A dedicated account. The server runs as the impostor system user with no shell and no home login.
  • A strict sandbox. The systemd unit applies NoNewPrivileges, ProtectSystem=strict, ProtectHome, PrivateTmp, an empty capability set and a read write allowance for /var/lib/impostor only. The .NET diagnostics socket is disabled outright.
  • Anticheat on, recorder off. Every anticheat check is enabled and the debug game recorder is not.
  • A minimal surface. TCP 22 and 22023, UDP 22023 — nothing else listens, and the build fails if anything else ever does.
cat /usr/share/doc/impostor/README.cloudimg

Terminal showing the shipped configuration with anticheat enabled and every check on, the compatibility settings refusing future game versions by default, the GPL 3.0 licence and the cloudimg source offer naming the exact upstream tag and artefact digest, and the service running as the dedicated impostor user

Recommendations:

  • Restrict the SSH rule in your NSG to your own address; only the two game port rules need Internet as a source.
  • Give players the address from the connection note, nothing else — there is nothing else to give.
  • If you run a public community server, watch the journal for ban activity and consider a plugin for lobby moderation.

Server components

Component Version Install path
Impostor server 1.10.6 /opt/impostor/Impostor.Server
ASP.NET Core runtime 8.0 (Ubuntu package, auto updated) /usr/lib/dotnet
Configuration — /etc/impostor/config.json
Plugins / libraries — /var/lib/impostor/plugins, /var/lib/impostor/libraries
Self test — /usr/local/sbin/impostor-selftest
Protocol probe — /usr/local/bin/impostor-udp-probe
Licence + source offer GPL 3.0 /usr/share/doc/impostor/

Filesystem layout

Mount point Size Description
/ 30 GB Root filesystem
/boot/efi 100 MB UEFI boot partition (Gen2 Hyper V)
/mnt varies Azure temporary resource disk

Key directories:

Path Purpose
/opt/impostor The server binary
/etc/impostor Configuration (symlinked into the working directory)
/var/lib/impostor Working directory: plugins and libraries
/var/lib/cloudimg First boot sentinel and bootstrap marker

Troubleshooting

Players cannot join, but the server "shows up". Almost always the NSG: Among Us needs UDP 22023 and TCP 22023 both open. The region list in the client is served over TCP; actual play needs UDP. Re-check both rules, then run the self test on the VM — if it reports OK, the server side is proven and the problem is network reachability from the player's side.

Players get "you are running an older/newer version". The client and server must speak compatible protocol versions. Check the supported range in Connecting from the game; after a game update, upgrade the server when upstream ships a release (see Upgrading the server), or as a stopgap enable Compatibility.AllowFutureGameVersions and restart.

The self test fails on the UDP step. Read what the probe printed. no response with the HTTP checks passing usually means a local firewall was added that blocks UDP. A protocol DISCONNECT response means the server parsed the handshake and refused it — the journal says why:

sudo journalctl -u impostor.service --no-pager | tail -20

The service is not running. impostor.service is deliberately gated on first boot completing — it will not start if the bootstrap marker is missing:

systemctl is-active impostor-firstboot.service impostor.service
sudo journalctl -u impostor-firstboot.service --no-pager | tail -20

The advertised address is wrong. The matchmaker hands players the Server.PublicIp value from the configuration. First boot manages it; if you have edited it by hand, put the VM's real public IP back (see the connection note) and restart the service.

Support

cloudimg images come with 24/7 support. Include the output of sudo /usr/local/sbin/impostor-selftest and the last lines of sudo journalctl -u impostor.service with any request.

Impostor itself is community software — for plugin development and game protocol questions, the upstream project and its community are the right place.