ndasusers's questions

This system has a boot partition on a dm-raid device.

I updated the system by standard methods from an older Ubuntu to the latest LTS. Now, if the kernel is updated by "apt-get upgrade", the new kernel will not load. Nor are the entries listed in the GRUB boot screen.

I have determined that update-grub works as I would expect, updating the partition mounted at /boot. However, when I boot it, GRUB reads the root drive /boot folder. It does not mount the raid isw_dbbbejgeca_Volume0p1 to /boot before starting up.

If I copy the contents of the mounted /boot drive to a folder, then unmount it and copy all the contents to the root drive /boot folder, the system will then boot the new kernels and show all the updates in the GRUB menu.

I need help to make sure GRUB will mount the raid based boot partition.

Next are some output from boot-repair tool.

 Boot Info Script e7fc706 + Boot-Repair extra info      [Boot-Info 23Nov2014]

============================= Boot Info Summary: ===============================

 => No boot loader is installed in the MBR of /dev/sdc.

    Operating System:  Ubuntu 14.04.1 LTS 
    Boot files:        /etc/fstab

============================ Drive/Partition Info: =============================

"blkid" output: ________________________________________________________________

Device           UUID                                   TYPE       LABEL

/dev/mapper/isw_dbbbejgeca_Volume0p1 840df97f-7154-49a3-aa9c-02bd092d416c   ext2       
/dev/mapper/isw_dbbbejgeca_Volume0p5 M9ln25-ua43-3S0c-xWeT-8Ejd-tk2U-kp5nNG LVM2_member 
/dev/mapper/server01-root c16300cf-e8da-4e2b-b34a-45d8fc12fb44   ext4       
/dev/mapper/server01-swap_1 b67b89f9-a131-46f8-b29b-0eb450e18a6a   swap       
/dev/sda                                                isw_raid_member 
/dev/sdb                                                isw_raid_member 
/dev/sdc1        08652f68-2f8e-4044-8c0b-9b33cb623bba   ext4       

========================= "ls -l /dev/disk/by-id" output: ======================

total 0
lrwxrwxrwx 1 root root  9 Jan 19 23:21 ata-OCZ-VERTEX_30565XA328O39Y3Y2A6G -> ../../sda
lrwxrwxrwx 1 root root  9 Jan 19 23:21 ata-OCZ-VERTEX_OH43J28TQB2Q7T570144 -> ../../sdb
lrwxrwxrwx 1 root root  9 Jan 19 23:21 ata-WDC_WD20EARS-00MVWB0_WD-WCAZA1927955 -> ../../sdc
lrwxrwxrwx 1 root root 10 Jan 19 23:11 ata-WDC_WD20EARS-00MVWB0_WD-WCAZA1927955-part1 -> ../../sdc1
lrwxrwxrwx 1 root root 10 Jan 19 23:11 dm-name-isw_dbbbejgeca_Volume0 -> ../../dm-0
lrwxrwxrwx 1 root root 10 Jan 19 23:21 dm-name-isw_dbbbejgeca_Volume0p1 -> ../../dm-1
lrwxrwxrwx 1 root root 10 Jan 19 23:21 dm-name-isw_dbbbejgeca_Volume0p2 -> ../../dm-2
lrwxrwxrwx 1 root root 10 Jan 19 23:11 dm-name-isw_dbbbejgeca_Volume0p5 -> ../../dm-3
lrwxrwxrwx 1 root root 10 Jan 19 23:21 dm-name-server01-root -> ../../dm-4
lrwxrwxrwx 1 root root 10 Jan 19 23:21 dm-name-server01-swap_1 -> ../../dm-5
lrwxrwxrwx 1 root root 10 Jan 19 23:11 dm-uuid-DMRAID-isw_dbbbejgeca_Volume0 -> ../../dm-0
lrwxrwxrwx 1 root root 10 Jan 19 23:21 dm-uuid-LVM-P3d2Ucn1G9Wx7NUE0e5vNgabXjXrfHIe555TD7gDdpyqH82c1sP9ofmm1Ook2SIS -> ../../dm-4
lrwxrwxrwx 1 root root 10 Jan 19 23:21 dm-uuid-LVM-P3d2Ucn1G9Wx7NUE0e5vNgabXjXrfHIeA3DF0518wh8WsbW9i1cbOrcywyAwRUAg -> ../../dm-5
lrwxrwxrwx 1 root root 10 Jan 19 23:21 dm-uuid-part1-DMRAID-isw_dbbbejgeca_Volume0 -> ../../dm-1
lrwxrwxrwx 1 root root 10 Jan 19 23:21 dm-uuid-part2-DMRAID-isw_dbbbejgeca_Volume0 -> ../../dm-2
lrwxrwxrwx 1 root root 10 Jan 19 23:11 dm-uuid-part5-DMRAID-isw_dbbbejgeca_Volume0 -> ../../dm-3
lrwxrwxrwx 1 root root 10 Jan 19 23:21 raid-isw_dbbbejgeca_Volume0-part1 -> ../../dm-1
lrwxrwxrwx 1 root root 10 Jan 19 23:21 raid-isw_dbbbejgeca_Volume0-part2 -> ../../dm-2
lrwxrwxrwx 1 root root 10 Jan 19 23:11 raid-isw_dbbbejgeca_Volume0-part5 -> ../../dm-3
lrwxrwxrwx 1 root root  9 Jan 19 23:21 wwn-0x50014ee2052521f1 -> ../../sdc
lrwxrwxrwx 1 root root 10 Jan 19 23:11 wwn-0x50014ee2052521f1-part1 -> ../../sdc1

========================= "ls -R /dev/mapper/" output: =========================

/dev/mapper:
control
isw_dbbbejgeca_Volume0
isw_dbbbejgeca_Volume0p1
isw_dbbbejgeca_Volume0p2
isw_dbbbejgeca_Volume0p5
server01-root
server01-swap_1

================================ Mount points: =================================

Device           Mount_Point              Type       Options

/dev/mapper/isw_dbbbejgeca_Volume0p1 /boot                    ext2       (rw)
/dev/mapper/server01-root /                        ext4       (rw,errors=remount-ro)
/dev/sdc1        /home/backup/repos       ext4       (rw)


=========================== server01-root/etc/fstab: ============================

--------------------------------------------------------------------------------
# /etc/fstab: static file system information.
#
# Use 'blkid -o value -s UUID' to print the universally unique identifier
# for a device; this may be used with UUID= as a more robust way to name
# devices that works even if disks are added and removed. See fstab(5).
#
#                
proc            /proc           proc    nodev,noexec,nosuid 0       0
/dev/mapper/server01-root /               ext4    errors=remount-ro 0       1
/dev/mapper/isw_dbbbejgeca_Volume0p1 /boot           ext2    defaults        0       2
/dev/mapper/server01-swap_1 none            swap    sw              0       0
/dev/scd0       /media/floppy0  auto    rw,user,noauto,exec,utf8 0       0
UUID=08652f68-2f8e-4044-8c0b-9b33cb623bba   /home/backup    ext4    defaults    0   2   

--------------------------------------------------------------------------------

========= Devices which don't seem to have a corresponding hard drive: =========

{All_DMRaid} 

=================== os-prober:
/dev/mapper/server01-root:The OS now in use - Ubuntu 14.04.1 LTS CurrentSession:linux

=================== blkid:
/dev/sda: TYPE="isw_raid_member"
/dev/sdb: TYPE="isw_raid_member"
/dev/mapper/isw_dbbbejgeca_Volume0p1: UUID="840df97f-7154-49a3-aa9c-02bd092d416c" TYPE="ext2"
/dev/mapper/isw_dbbbejgeca_Volume0p5: UUID="M9ln25-ua43-3S0c-xWeT-8Ejd-tk2U-kp5nNG" TYPE="LVM2_member"
/dev/mapper/server01-root: UUID="c16300cf-e8da-4e2b-b34a-45d8fc12fb44" TYPE="ext4"
/dev/mapper/server01-swap_1: UUID="b67b89f9-a131-46f8-b29b-0eb450e18a6a" TYPE="swap"

[dmraid -sa -c] isw_dbbbejgeca_Volume0
Set sda as corresponding disk of mapper/server01-root

1 disks with OS, 1 OS : 1 Linux, 0 MacOS, 0 Windows, 0 unknown type OS.

Warning: extended partition does not start at a cylinder boundary.
DOS and Linux will interpret the contents differently.

sfdisk: ERROR: sector 500734 does not have an msdos signature
Warning: extended partition does not start at a cylinder boundary.
DOS and Linux will interpret the contents differently.
Warning: invalid flag 0x616f of partition table 5 will be corrected by w(rite)
Warning: invalid flag 0x616f of partition table 5 will be corrected by w(rite)

=================== /etc/grub.d/ :
drwxr-xr-x  2 root    root        4096 Oct 21 10:25 grub.d
total 76
-rwxr-xr-x 1 root root  9761 Oct 28 09:08 00_header
-rwxr-xr-x 1 root root  6058 May  8  2014 05_debian_theme
-rwxr-xr-x 1 root root 11608 Nov  3 18:39 10_linux
-rwxr-xr-x 1 root root 10412 May 15  2014 20_linux_xen
-rwxr-xr-x 1 root root  1992 Mar 12  2014 20_memtest86+
-rwxr-xr-x 1 root root 11692 May 15  2014 30_os-prober
-rwxr-xr-x 1 root root  1416 May 15  2014 30_uefi-firmware
-rwxr-xr-x 1 root root   214 Oct  6  2010 40_custom
-rwxr-xr-x 1 root root   216 May 15  2014 41_custom
-rw-r--r-- 1 root root   483 Oct  6  2010 README

=================== /etc/default/grub :

# If you change this file, run 'update-grub' afterwards to update
# /boot/grub/grub.cfg.
# For full documentation of the options in this file, see:
#   info -f grub -n 'Simple configuration'

GRUB_DEFAULT=0
#GRUB_HIDDEN_TIMEOUT=0
GRUB_HIDDEN_TIMEOUT_QUIET=true
GRUB_TIMEOUT=2
GRUB_DISTRIBUTOR=`lsb_release -i -s 2> /dev/null || echo Debian`
GRUB_CMDLINE_LINUX_DEFAULT="ipv6.disable=1 quiet"
GRUB_CMDLINE_LINUX=""

# Uncomment to enable BadRAM filtering, modify to suit your needs
# This works with Linux (no patch required) and with any kernel that obtains
# the memory map information from GRUB (GNU Mach, kernel of FreeBSD ...)
#GRUB_BADRAM="0x01234567,0xfefefefe,0x89abcdef,0xefefefef"

# Uncomment to disable graphical terminal (grub-pc only)
#GRUB_TERMINAL=console

# The resolution used on graphical terminal
# note that you can use only modes which your graphic card supports via VBE
# you can see them in real GRUB with the command `vbeinfo'
#GRUB_GFXMODE=640x480

# Uncomment if you don't want GRUB to pass "root=UUID=xxx" parameter to Linux
#GRUB_DISABLE_LINUX_UUID=true

# Uncomment to disable generation of recovery mode menu entries
#GRUB_DISABLE_RECOVERY="true"

# Uncomment to get a beep at grub start
#GRUB_INIT_TUNE="480 440 1"

/boot detected in the fstab of mapper/server01-root: /dev/mapper/isw_dbbbejgeca_Volume0p1  (mapper/isw_dbbbejgeca_Volume0p1)

=================== mapper/server01-root/etc/mdadm/mdadm.conf :
# mdadm.conf
#
# Please refer to mdadm.conf(5) for information about this file.
#

# by default (built-in), scan all partitions (/proc/partitions) and all
# containers for MD superblocks. alternatively, specify devices to scan, using
# wildcards if desired.
#DEVICE partitions

# auto-create devices with Debian standard permissions
CREATE owner=root group=disk mode=0660 auto=yes

# automatically tag new arrays as belonging to the local system
HOMEHOST 

# instruct the monitoring daemon where to send mail alerts
MAILADDR root

# definitions of existing MD arrays
ARRAY metadata=imsm UUID=a624f30e:6036d720:067d7817:ea238d58
ARRAY /dev/md/Volume0 container=a624f30e:6036d720:067d7817:ea238d58 member=0 UUID=03fe4a37:77503687:17ce6055:d75a6ac2

=================== PARTITIONS & DISKS:
mapper/server01-root    : sdb,  .
mapper/isw_dbbbejgeca_Volume0p1 : mapper/isw_dbbbejgeca_Volume0,    /boot.
sdb : not-GPT,  BIOSboot-not-needed,    has-no-EFIpart,     not-usb,    has-os, 2048 sectors * 512 bytes
sda : not-GPT,  BIOSboot-not-needed,    has-no-EFIpart,     not-usb,    no-os,  2048 sectors * 512 bytes
mapper/isw_dbbbejgeca_Volume0   : not-GPT,  BIOSboot-not-needed,    has-no-EFIpart,     not-usb,    no-os,  2048 sectors * 512 bytes

=================== mount:
/dev/mapper/server01-root on / type ext4 (rw,errors=remount-ro)
/dev/mapper/isw_dbbbejgeca_Volume0p1 on /boot type ext2 (rw)

=================== ls:
Disk /dev/mapper/isw_dbbbejgeca_Volume0p1 doesn't contain a valid partition table
fdisk: unable to read /dev/mapper/isw_dbbbejgeca_Volume0p2: Inappropriate ioctl for device

=================== df -Th:
Filesystem                           Type      Size  Used Avail Use% Mounted on
/dev/mapper/server01-root             ext4      225G  209G  4.7G  98% /
/dev/mapper/isw_dbbbejgeca_Volume0p1 ext2      229M  123M   94M  57% /boot
/dev/sdc1                            ext4      1.8T  573G  1.2T  33% /home/backup

=================== fdisk -l:

Disk /dev/sda: 128.0 GB, 128035676160 bytes
255 heads, 63 sectors/track, 15566 cylinders, total 250069680 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x00087dad

Device Boot      Start         End      Blocks   Id  System
/dev/sda1             512      500223      249856   83  Linux
/dev/sda2          500734   500130303   249814785    5  Extended
/dev/sda5   ?   809621278  1718751574   454565148+  32  Unknown

Disk /dev/sdb: 128.0 GB, 128035676160 bytes
255 heads, 63 sectors/track, 15566 cylinders, total 250069680 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x99e561ed

Device Boot      Start         End      Blocks   Id  System

Disk /dev/mapper/isw_dbbbejgeca_Volume0: 256.1 GB, 256066715648 bytes
255 heads, 63 sectors/track, 31131 cylinders, total 500130304 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 131072 bytes / 262144 bytes
Disk identifier: 0x00087dad

Device Boot      Start         End      Blocks   Id  System
/dev/mapper/isw_dbbbejgeca_Volume0p1             512      500223      249856   83  Linux
/dev/mapper/isw_dbbbejgeca_Volume0p2          500734   500130303   249814785    5  Extended
Partition 2 does not start on physical sector boundary.
/dev/mapper/isw_dbbbejgeca_Volume0p5          500736   500130303   249814784   8e  Linux LVM

Disk /dev/mapper/isw_dbbbejgeca_Volume0p1: 255 MB, 255852544 bytes
255 heads, 63 sectors/track, 31 cylinders, total 499712 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 131072 bytes / 262144 bytes
Disk identifier: 0x00000000


Partition outside the disk detected.


=================== Suggested repair
The default repair of the Boot-Repair utility would purge 
(in order to enable-raid enable-lvm) and reinstall the 
grub2 of mapper/server01-root into the MBR of sdb, using 
the following options:
        mapper/isw_dbbbejgeca_Volume0p1/boot,
The boot flag would be placed on sdc1.
Additional repair would be performed:
        unhide-bootmenu-10s


=================== Advice in case of suggested repair
Warning: continuing without internet would leave your system 
unbootable. Please connect internet.
Do you want to continue?


=================== Final advice in case of suggested repair
Please do not forget to make your BIOS boot on sdb (128GB) disk!


=================== User settings
The settings chosen by the user will not act on the boot.

I am not sure of the suggestions.

The boot flag would be placed on sdc1.

sdc1 is a backup disk, it will not be there always. I don't need a boot setup on that disk I think.

I am worried it may become unbootable. This boot-repair requires internet, but that server will not be accessing the internet.

So, I ask you to share some grub commands to do the other steps:

 purge and reinstall the grub2 of mapper/server01-root into the MBR of sdb, using the following options:
    mapper/isw_dbbbejgeca_Volume0p1/boot,
 Additional repair would be performed:
    unhide-bootmenu-10s

I have a CISCO ASA 5505 in a home office. It has two subnet, public and private. There is a wifi belkin router on the private net, which provides wifi for some users. That belkin router sends out heartbeat notice to a pre-programmed ip address, but the packet is dropped by the ASA. I do not want the packet to go through. I prefer the Belkin be unable to phone home like that, but this belkin cannot disable the heartbeat check.

So, I wonder if I can make the ASA reply back to the the belkin hello instead?

Or maybe you can tell me how to make a forwarding setting with the ASA that can re-direct the heartbeat check to a host on the LAN by mapping the phone home IP address to the local network?

Here is the firewall drop message from the belkin in the ASA.

3 datetime 50.16.219.4 192.168.3.5 Deny inbound icmp src outside:50.16.219.4 dst inside:192.168.3.5 (type 0, code 0)

I'm comfortable with the CISCO ASDM interface, but I managed some config on the command line too.

Another internal DNS server (like this cure) is not really an option at this point.

Thank you for any advice.

Sorry for the long question. I try to add as many details as I have.

On server_1 I have a systems account user named backup which has a home directory where the cron jobs read the backup scripts.

backup@server_1~]$ ls 
script_1    script_2 ...

On server_2 I have created a standard user "backup" to hold some repositories that are currently backed up on server_1. Those backed up fine for months. Now, I have added a link to a new repo in /srv which is owned by the user & group srv.

backup@server_2~]$ ls 
drwxrwxr.. backup:backup   repo_1
drwxrwxr.. backup:backup   repo_2 
lrwxrwx... backup:backup   repo_3 -> /srv/repo_3

backup@server_2~]$ ls /srv
drwxrwxr.. srv:srv         repo_3
       ^ notice the r, indicating any user should be able to read this data too.

I then added backup on server_2 into the srv group, so that backup should be able to read all the data for a sync down onto server_1.

root@server_2~]# usermod -a -G srv backup

Then I tried to rsync:

backup@server_1~]$ rsync -avi -e "ssh -i /home/backup/.ssh/server_2_ssh_key" \
                   backup@server_2/srv/repo_3 ./

The problem is, when I run the backup script, using the passwordless login from server_1, it fails to read data, because rsync is unable to change to directory /srv/repo_3 due to "permission denied" The same happens when I tried using the symlink.

backup@server_1~]$ rsync -avi -e "ssh -i /home/backup/.ssh/server_2_ssh_key" \
                   backup@server_2/home/backup/repo_3 ./

Then I even logged in using the backup users key pair to server_1 and I am unable to even list the contents of /srv/repo_3

I happen to have another standard user account on server_2 which uses an SSH Key Login that has a password. When I login that way, "user_2" is am able to list the contents of /srv

So, I copied the second users' ssh key from server_2 into /home/backup/.ssh/ssh_key_w_password on server_1, and added the public part to backup's trusted hosts on server_2. Then I tried the backup using that key.

backup@server_1~]$ rsync -avi -e "ssh -i /home/backup/.ssh/ssh_key_w_password" \
                   backup@server_2/home/backup/repo_3 ./
Password for ssh_key_w_password: 

I enter the password and the backup ran correctly, even though user_2 is not even in the backup or srv group on server_2. It works by the symlink or by the direct location /srv/repo_3.

Some user details:

 backup@server_2~]$ cat /etc/passwd | grep backup
 backup:x:1008:1008:backup:/home/backup:/bin/bash
 backup@server_2~]$ groups
 backup srv

 user_2@server_2~]# cat /etc/passwd | grep user_2
 user_2:x:1012:1012:user_2:/home/user_2:/bin/bash
 root@server_2~]# groups user_2
 user_2

 user_2@server_2~]$ cat /etc/passwd | grep srv
 srv:x:1018:1021::/home/srv:/bin/bash
 user_2@server_2~]$ groups srv
 srv : srv mycorp 4h jndj ax

There we are. The only difference I can find from my side is that backup uses a passwordless key-pair from server_1, while the other standard user has the password on the SSH key.

Can anyone help me understand what is different or what I am missing? I must have backup on server_1 use the pwordless login to run the sync. I cannot allow server_2 to sync up to server_1.

Update: re: MadHatter's comment Login direct fails as backup from server1 because the password based login is not permitted. But using the password-less key returns output (as does the same attempt with the password key from the other user.

[backup@server_1 ~]$ ssh backup@server_2 "id -a"
backup@server_2's password:
Permission denied, please try again.

[backup@server_1 ~]$ ssh -i .ssh/backup_server_2_ssh.key backup@server_2 "id -a"
uid=1008(backup) gid=1008(backup) groups=1008(backup),1021(srv)
[backup@server_1 ~]$
[backup@server_1 ~]$ ssh -i .ssh/ssh_key_w_password user_2@server_2 "id -a"
Enter passphrase for key '.ssh/ssh_key_w_password':
uid=1012(user_2) gid=1012(user_2) groups=1012(user_2)
[backup@server_1 ~]$ 

For reference, this is the fail log messages from rsync when I just tried again using the passwordless login as root on server_1.

[root@server_1 ~]# bash /home/backup/add_srv.sh
2013-11-18 12:24:14 - ************ Backup Robot Checking In **********
.... login and mount backup destination goes ok here rsync fail is below ....
2013/11/18 12:24:20 [920] receiving file list
2013/11/18 12:24:20 [920] rsync: change_dir "/srv" failed: Permission denied (13)
2013/11/18 12:24:20 [920] sent 8 bytes  received 10 bytes  12.00 bytes/sec
2013/11/18 12:24:20 [920] total size is 0  speedup is 0.00
2013/11/18 12:24:20 [920] rsync error: some files/attrs were not transferred (see previous errors) (code 23) at main.c(1505) [receiver=3.0.6]
[root@server_1 ~]#

After upgrading to Fedora 18, Synergy, the keyboard sharing system was blocked by default. The culprit was firewalld, which happily ignored my previous settings made in the Fedora GUI, backed by iptables.

~]$ ps aux | grep firewall
root      3222  0.0  1.2  22364 12336 ?        Ss   18:17   0:00 /usr/bin/python /usr/sbin/firewalld --nofork
david     3783  0.0  0.0   4788   808 pts/0    S+   20:08   0:00 grep --color=auto firewall
~]$ 

Ok, so how to get around this? I did sudo killall firealld for several weeks, but that got annoying every time I rebooted. It was time to look for some clues. There were several one liners, but they did not work for me. They kept spitting out the help text. For example:

~]$ sudo firewall-cmd --zone=internal --add --port=24800/tcp
[sudo] password for auser: 
option --add not a unique prefix

Also, posts that clamied this command worked also stated it was temporary, unable to survive a reboot. I ended up adding a file to the config directory to be loaded in on boot.

Would anyone be able to have a look at that and see if I missed something? Though synergy works, when I run the list command, I get no result:

~]$ sudo firewall-cmd --zone=internal --list-services
ipp-client mdns dhcpv6-client ssh samba-client
~]$ sudo firewall-cmd --zone=internal --list-ports
~]$

I needed my script to email admin if there is a problem, and the company only uses Gmail. Following a few posts instructions I was able to set up mailx using a .mailrc file. there was first the error of nss-config-dir I solved that by copying some .db files from a firefox directory. to ./certs and aiming to it in mailrc. A mail was sent.

However, the error above came up. By some miracle, there was a Google certificate in the .db. It showed up with this command:

~]$ certutil -L -d certs

Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI

GeoTrust SSL CA                                              ,,
VeriSign Class 3 Secure Server CA - G3                       ,,
Microsoft Internet Authority                                 ,,
VeriSign Class 3 Extended Validation SSL CA                  ,,
Akamai Subordinate CA 3                                      ,,
MSIT Machine Auth CA 2                                       ,,
Google Internet Authority                                    ,,

Most likely, it can be ignored, because the mail worked anyway. Finally, after pulling some hair and many googles, I found out how to rid myself of the annoyance.

First, export the existing certificate to a ASSCII file:

~]$ certutil -L -n 'Google Internet Authority'  -d certs -a > google.cert.asc

Now re-import that file, and mark it as a trusted for SSL certificates, ala:

~]$ certutil -A -t "C,," -n 'Google Internet Authority'  -d certs -i google.cert.asc

After this, listing shows it trusted:

~]$ certutil -L -d certs

Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI
...
Google Internet Authority                                    C,,

And mailx sends out with no hitch.

~]$ /bin/mailx -A gmail -s "Whadda ya no" [email protected]
ho ho ho
EOT
~]$

I hope it is helpful to someone looking to be done with the error.

Also, I am curious about somethings.

How could I get this certificate, if it were not in the mozilla database by chance? Is there for instance, something like this?

    ~]$ certutil -A -t "C,," \
                 -n 'gmail.com'  \
                 -d certs \
                 -i 'http://google.com/cert/this...'