external-cryptobone-admin(8)

📦 version 2.2, in fedora 43, fedora 44

✨ external-cryptobone-admin(8) ✨

okay bestie, welcome to the manual page for external-cryptobone-admin, section 8 of the manual, and it's literally the glow-up tool for turning a plain Linux box into a whole external Crypto Bone 💖

🌸 NAME 🌸

external-cryptobone-admin — the admin tool for an external Crypto Bone device. that's the whole vibe, she's a manager 🫶

🎀 SYNOPSIS 🎀

/usr/bin/external-cryptobone-admin

no flags, no arguments, no drama. she just runs 💅

🦋 DESCRIPTION 🦋

so listen. cryptobone2 is the graphical user interface (GUI) for a secure messaging system, and its whole personality is making sure a user's messages and attachment files are always AES end-to-end encrypted. no cap. 🔥

in its default mode, the cryptobone2 program uses an encrypted data base of keys that are stored on the same machine — that's the ALL-IN-ONE mode, and the GUI has access to these message encryption keys through a cryptobone daemon that's running on the same machine as a process with root permission. yes, root. we said what we said 👑

you can get extra protection of the message keys by using a second, external device to store the encryption keys — that's the external Crypto Bone. this external device can be another Linux computer dedicated to this exact task, or a Raspberry Pi, or honestly any other device capable of installing the Crypto Bone software 🍓

the program external-cryptobone-admin handles all the administrative tasks for turning a Linux computer into an external Crypto Bone that can be used from a different machine with the cryptobone2 GUI. and here's the thing — both components, the ALL-IN-ONE Crypto Bone and the EXTERNAL Crypto Bone, ship in the same package, but they are designed to run on different computer systems. when you're only using one computer system for the Crypto Bone, the ALL-IN-ONE version is the recommended one, because it communicates directly to the cryptobone daemon via a UNIX socket. iykyk ✨

📌 after installation, the external Crypto Bone is not enabled. like, it's asleep. napping. adorable. 😴

when the external Crypto Bone is enabled through the program external-cryptobone-admin, the system will create three secrets that need to be transferred to the Linux computer on which the cryptobone2 GUI is running. after enabling the external Crypto Bone, the external device writes these secrets into the device's ramdisk (/dev/shm/BOOT). iconic behaviour, honestly 🧚

after generation of these secrets they need to be transferred to the client machine where the cryptobone2 GUI is active. for the deets, refer to the comments in the file "ext/initialkeysetup" and "ext/README.external". go read them, bestie, they're the group chat receipts 📩

the administration tool also lets you replace the standard firewall daemon with a more restrictive firewall configuration that isolates the device on which the external Crypto Bone is running as much as possible. locked down. protected. main character energy 🔒

in additon — yes, additon, we're keeping it — the secure shell daemon can be hardened to disallow password login and root login via port 22, when it is no longer needed. the external Crypto Bone will be contacted via ssh using the RSA public key authentication method only, and only from the main machine. the necessary RSA private key is one of the three secrets and must be transferred to the main Linux computer manually before the secure shell daemon is hardened on the external device. manual transfer. by hand. with your actual hands. 🫶

⚠️ note that enabling the restrictive firewall and hardening sshd would impede the use as a general-purpose computer — but that is exactly what is intended when a system is used as an isolated, external Crypto Bone. it's not a bug, it's the aesthetic 💅

finally, the external Crypto Bone can be reset — in which case the encrypted data base and all access information for the ssh tunnel is lost. 😭 be extra careful when using this reset button, because this option is for the unlikely event that you willfully want to destroy all external Crypto Bone data to re-start pristinely. like, genuinely, this is the nuclear option, treat it with the respect it deserves 💀

💜 OPTIONS 💜

  • none — that's it. zero. nothing. she needs no flags, she simply is 🌈

🌟 FILES 🌟

  • /usr/bin/external-cryptobone-admin

👑 SEE ALSO 👑

  • libcl (3)
  • cryptoboned (8)
  • cryptobone2 (8)

go read those too, they're the supporting cast and they ate 🎀

🫶 AUTHORS 🫶

external-cryptobone-admin has been written by Ralf Senderek <innovation@senderek.ie>.

the core cryptographic library libcl.so which is used by the cryptobone daemon has been written by Peter Gutmann <pgut001@cs.auckland.ac.nz>.

two absolute legends, no notes 💖

🐛 BUGS 🐛

of course there aren't bugs 💀 but if you find any, please sent them to innovation@senderek.ie. (yes, "sent". we're keeping it. it's part of the charm now 🙈)

and that's the page, bestie!! this one came from the external-cryptobone-admin(8) manual, credited to Ralf Senderek and labelled external-cryptobone-admin(8) down at the bottom — stay encrypted, stay iconic, mwah 💋✨

📦 where this page comes from