The Cryptobone software comprises of two separate parts, the ALL-IN-ONE software
and the EXTERNAL software.

The EXTERNAL software is located entirely in this directory: /usr/lib/cryptobone/ext
If this machine is meant to function as an external device, the daemon cryptoboneexternd
will be run on this machine instead of the daemon cryptoboned, that is run on the 
other machine (the client) which provides the GUI.

To enable the EXTERNAL software on this machine you'd run the following command (as root):

    /bin/external-cryptobone enable

This command will not only start the external daemon, it will also make sure that the file
/usr/lib/cryptobone/safewebdrop.header is set correctly, so that ${CBHOME} is set to the
directory above (/usr/lib/cryptobone/ext) and the ramdisk is /dev/shm/EXRAM on this machine.

As a result the daemon cryptoboneexternd will be started via the script 
/usr/lib/cryptobone/ext/init.d/cryptoboneexternd

When the daemon is started for the first time there is no database file and no master key
to encrypt it. There is also no user "cryptobone" that can open a ssh tunnel to this machine
and no ssh private and public key for this user.

To produce all these secrets is the purpose of the script /usr/lib/cryptobone/ext/initialkeysetup.
(see comments for details)

The external daemon is now stuck in a loop waiting for the master key to be sent from the client
machine, the one that runs the GUI. But to be able to sent the master key from the client machine,
all secrets that have been stored in the ramdisk /dev/shm/BOOT on the external device must 
manually be transferred to the client machine into the same directory /dev/shm/BOOT.
Once the secrets (masterkey, ssh private key and local key) have been transferred to the client
machine, the GUI can request a copy into the client's database.

After the next reboot of the client machine the master key will be uploaded to the external
device and the external daemon creates the (encrypted) database and goes into active mode.
No reboot of the external machine is necessary.

As long as the external device is running the cleartext messages and attachment files are
located in the ramdisk /dev/shm/EXRAM exclusively and the GUI on the client machine can
request everything from the external device through the ssh tunnel in the same way as it
would directly query the daemon on the client machine while operating in ALL-IN-ONE mode.

The process of transferring the three secrets from the external device to the client machine
is explained in the script /usr/lib/cryptobone/ext/initialkeysetup, where the secrets are 
being generated.


