text:
Key Rollover
In Debian Security Advisory 1571, the Debian Security Team disclosed a weakness in the random number generator used by OpenSSL on Debian and its derivatives. As a result of this weakness, certain encryption keys are much more common than they should be, such that an attacker could guess the key through a brute-force attack given minimal knowledge of the system. This particularly affects the use of encryption keys in OpenSSH, OpenVPN and SSL certificates.
This page documents how to perform key rollover procedures for packages whose keys are affected by the OpenSSL vulnerability.
- OpenSSH
- OpenSSL: Generic PEM key generation instructions
- bincimap
- boxbackup
- cryptsetup
- dropbear
- ekg
- ftpd-ssl
- gforge
- MIT Kerberos (krb5)
- Nessus
- OpenSWAN / StrongSWAN
- OpenVPN
- Proftpd
- puppet
- sendmail
- ssl-cert
- telnetd-ssl
- tinc
- tor
- xrdp
Other software uses cryptographic keys, but is not vulnerable as OpenSSL is not used to generate or exchange its keys.
For key rollover instructions for other software, you might want to check the user-submitted information in https://wiki.debian.org/SSLkeys
An updated package has been released via DSA-1576, which eases key transformation.
1. Install the security updates in DSA-1576
Once the update is applied, weak user keys will be automatically rejected where possible (though they cannot be detected in all cases). If you are using such keys for user authentication, they will immediately stop working and will need to be replaced (see step 3).
OpenSSH host keys can be automatically regenerated when the OpenSSH security update is applied. The update will prompt for confirmation before taking this step.
2. Update OpenSSH known_hosts files
The regeneration of host keys will cause a warning to be displayed when connecting to the system using SSH until the host key is updated in the known_hosts file on the client. The warning will look like this:
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that the RSA host key has just been changed.
In this case, the host key has simply been changed, and you should update the relevant known_hosts file as indicated in the warning message. It is recommended that you use a trustworthy channel to exchange the server key. It is found in the file /etc/ssh/ssh_host_rsa_key.pub on the server; it's fingerprint can be printed using the command:
ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key.pub
In addition to user-specific known_hosts files, there may be a system-wide file /etc/ssh/ssh_known_hosts. This file is used both by the ssh client and by sshd for the hosts.equiv functionality. This file needs to be updated as well.
3. Check all OpenSSH user keys
The safest course of action is to regenerate all OpenSSH user keys, except where it can be established to a sufficient high degree of certainty that the key was generated on an unaffected system.
Check whether your key is affected by running the ssh-vulnkey tool, included in the security update. By default, ssh-vulnkey will check the standard location for user keys (~/.ssh/id_rsa, ~/.ssh/id_dsa and ~/.ssh/identity), your authorized_keys file (~/.ssh/authorized_keys and ~/.ssh/authorized_keys2), and the system's host keys (/etc/ssh/ssh_host_dsa_key and /etc/ssh/ssh_host_rsa_key).
To check all your own keys, assuming they are in the standard locations (~/.ssh/id_rsa, ~/.ssh/id_dsa, or ~/.ssh/identity):
To check all keys on your system:
sudo ssh-vulnkey -a
To check a key in a non-standard location:
ssh-vulnkey /path/to/key
If ssh-vulnkey says
Unknown (no blacklist information), then it has no
information about whether that key is affected. If in doubt, destroy the
key and generate a new one.
4. Regenerate any affected user keys
OpenSSH keys used for user authentication must be manually regenerated, including those which may have been transferred to a different system after being generated.
New keys can be generated using ssh-keygen, e.g.:
$ ssh-keygen Generating public/private rsa key pair. Enter file in which to save the key (/home/user/.ssh/id_rsa): Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /home/user/.ssh/id_rsa. Your public key has been saved in /home/user/.ssh/id_rsa.pub. The key fingerprint is: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00 user@host
5. Update authorized_keys files (if necessary)
Once the user keys have been regenerated, the relevant public keys must be propagated to any authorized_keys files (and authorized_keys2 files, if applicable) on remote systems. Be sure to delete the affected key.
OpenSSL: Generic PEM key generation instructions
This is just a reminder for those who (re-)generate PEM encoded certificates. Your site probably has other policies in place about how to manage keys which you should follow. Additionally, you may need to get the certificates signed again by a 3rd party Certificate Authority rather than by using a self-signed certificate as shown below:
cd /etc/ssl/private openssl genrsa 1024 > mysite.pem cd /etc/ssl/certs openssl req -new -key ../private/mysite.pem -x509 -days 9999 -out mysite.pem
The bincimap package automatically creates a self-signed certificate through the openssl program for the bincimap-ssl service, and puts it into /etc/ssl/certs/imapd.pem. To regenerate, run:
rm -f /etc/ssl/certs/imapd.pem dpkg-reconfigure bincimap
Boxbackup is not present in Debian stable, only in testing/Lenny.
Upstream has published a first impact analysis of key material created on system with insufficient random PRNG. You can read the details here.
If the PRNG in your OpenSSL was insufficiently random, you need to:
- Regenerate all affected certificates, which have been generated or signed on an affected system
- Regenerate all the data keys (*-FileEncKeys.raw)
- Destroy the data stored on your server to an appropriate level of security (overwrite with zeros at the least, more if you're paranoid)
- Upload everything again
- Take appropriate measures under the assumption that you have been storing your data in plain text on a public server without authentication. (i.e., start from scratch, destroying all trace of the backed up data, and take other measures to mitigate the exposure of your secrets)
Cryptsetup itself does not use openssl for encryption (this applies to both LUKS and dm-crypt devices).
If cryptsetup has been configured to use SSL-encrypted keyfiles (a non-default setup which must be explicitly configured by the user) and a broken version of openssl was used to generate the keyfile, the keyfile encryption may be weaker than expected (as the salt is not truly random).
The solution is either to re-encrypt the keyfile (if you are reasonably certain that the encrypted key has not been disclosed to any third parties) or to wipe and reinstall the affected partition(s) using a new key.
Instructions for re-encrypting a keyfile:
Do the following for each SSL-encrypted keyfile, replacing <ssl_encrypted_key_path> with the path to the actual keyfile:
tmpkey=$(tempfile) openssl enc -aes-256-cbc -d -salt -in <ssl_encrypted_key_path> -out "$tmpkey" shred -uz <ssl_encrypted_key_path> openssl enc -aes-256-cbc -e -salt -in "$tmpkey" -out <ssl_encrypted_key_path> shred -uz "$tmpkey"
If you have /etc/ssh/*host* keys, either remove them, or follow the openssh instructions first, before updating dropbear's keys.
Dropbear's postinst converts existing openssh keys to dropbear format, if it cannot find the dropbear host keys.
rm /etc/dropbear/*_host_key dpkg-reconfigure dropbear
Note that keys that have been generated by Dropbear itself are not vulnerable (it uses libtomcrypt rather than OpenSSL).
Users of programs ekg or ekg2 (the latter is only in experimental) who
use the
SIM encryption functionality, who generated a keypair using
/key [-g|--generate] command (which uses libssl to do the job)
should regenerate the keys, after upgrading libssl and restarting the
The upstream developers have posted a notice on their website: http://ekg.chmurka.net/index.php
If you need further help, please ask on email@example.com or firstname.lastname@example.com (both English and Polish).
rm -f /etc/ftpd-ssl/ftpd.pem /etc/ssl/certs/ftpd.pem dpkg-reconfigure ftpd-ssl
This covers the default setup. If the local admin has setup further SSL infrastructure beyond that, these keys will need to be regenerated as well.
The gforge-web-apache2 package in sid and lenny sets up the website
with a dummy certificate if no existing certificate is found. Users are then
encouraged to replace it with a
real one. The dummy certificate in
question is the Snake Oil one, so it should already be known as a weak
one (even without the SSL bug), but some users may accept
it without a second thought.
MIT Kerberos (krb5)
No part of MIT Kerberos in Debian 4.0 (
Etch) uses OpenSSL, and so Kerberos
in Debian 4.0 is not affected at all.
In Lenny the separate binary package krb5-pkinit uses OpenSSL. MIT Kerberos itself does not generate long-term key pairs even when the PKINIT plugin is used, so any vulnerable long-term key pairs would have been generated outside of the MIT Kerberos software itself. The PKINIT plugin only references existing key pairs and isn't responsible for key management.
Long-term key pairs used with PKINIT may be affected if generated on an affected Debian system, but such generation is external to MIT Kerberos.
However, the OpenSSL random key functions are used for the DH exchange when PKINIT authentication is used, which means that an attacker may be able to use brute-force to gain access to the KDC response to a PKINIT authentication and subsequently gain access to any sessions created using service tickets from that authentication.
Any KDCs using the PKINIT plugin from Lenny should have their libssl0.9.8 packages upgraded immediately and the Kerberos KDC restarted with:
/etc/init.d/krb5-kdc restart
Any Kerberos ticket-granting tickets (TGTs) or encrypted sessions resulting from PKINIT authentication using a Kerberos KDC with the affected libssl should be treated as suspect; it's possible that attackers with packet captures will be able to compromise those keys and sessions.
The Nessus server package (nessusd) post installation script creates some SSL keys for secure communication between a Nessus server and client. That communication channel should be considered compromised since a rogue user could be able to intercept the information exchanged between the server and the client (which includes information of remote hosts vulnerabilities) and potentially could send commands to the servers as the logged in user.
Additionally, if the admin has created either the Nessus CA key or a user
certificate (with nessus-mkcert-client) for remote authentication in a server
which had installed the OpenSSL version affected by this security issue those
keys should be considered compromised. Note that remote users with access to
the Nessus server can launch attacks to the servers they are allowed to attack
and, if enabled on the local configuration (in Debian it defaults to
upload plugins which would be executed in the Nessus server with root
The maintainer configuration scripts will regenerate the OpenSSL certificates when configured if it cannot find them. You will need to remove the certificates and have it generate new ones doing:
rm -f /var/lib/nessus/CA/cacert.pem rm -f /var/lib/nessus/CA/servercert.pem rm -f /var/lib/nessus/private/CA/cakey.pem rm -f /var/lib/nessus/private/CA/serverkey.pem dpkg-reconfigure nessusd
Once this is done you will have to remove the old user keys at /var/lib/nessus/users/USERNAME/auth and regenerate them again with nessus-mkcert-client. Old keys will be invalid once the CA key has been removed.
After the CA key is regenerated you will also need to distribute the new CA
certificate to your users, and your users will have to accept the new certificate
from the Nessus server once they reconnect. Certificate settings for the old
server should be removed automatically but you can also remove them manually by
editing the
.nessusrc.cert (if using the Nessus client) or
.openvasrc.cert (if using the OpenVAS client).
OpenSWAN / StrongSWAN
rm /etc/ipsec.d/private/`hostname`Key.pem /etc/ipsec.d/certs/`hostname`Cert.pem dpkg-reconfigure (open|strong)swan /etc/init.d/ipsec restart
Beware: Restarting the ipsec services terminates all currently open IPSec connections, which may need to be restarted from the other end.
Backup your secret key files. While key names are arbitrary, they can be detected by running
grep secret /etc/openvpn/*.conf
Recreate them using
openvpn --genkey --secret SECRET_FILENAME
Then copy the shared secret keys to the remote hosts and restart the VPN on each host with
/etc/init.d/openvpn force-reload
The Debian packaging doesn't include key generation, so the following steps should only be necessary if SSL keys have been created externally.
An upcoming proftpd upload to unstable will include a tls.conf template with the comment below.
Note that the self-signed certificate generation is bit different from that suggested on the general openssl section, in order to avoid using of an explicit password at daemon startup.
You can (re-)generate a self-signed certificate using a command like:
openssl req -x509 -newkey rsa:1024 -keyout /etc/ssl/private/proftpd.key -out /etc/ssl/certs/proftpd.crt -nodes -days 365
Both files must be readable by root only. The file paths can be checked/configured through the following configuration directives:
TLSRSACertificateFile /etc/ssl/certs/proftpd.crt TLSRSACertificateKeyFile /etc/ssl/private/proftpd.key TLSCACertificateFile /etc/ssl/certs/CA.pem TLSOptions NoCertRequest
There are two methods to handle puppet certificates, one is via capistrano, the second is manually.
Regenerating Puppet SSL Certificates using capistrano is detailed here: http://reductivelabs.com/trac/puppet/wiki/RegenerateSSL
The manual steps are as follows:
- You need to wipe and regenerate your CA info:
/etc/init.d/puppetmaster stop rm -rf $vardir/ssl/* /etc/init.d/puppetmaster start
However, if you are running mongrel, instead of starting puppetmaster from the init script, you will need to first stop the front-end web listener (apache, nginx, etc.) and then do the following:
puppetmasterd --daemonize ; sleep 30 ; pkill -f 'ruby /usr/sbin/puppetmasterd'
The above is necessary because for some reason when running with mongrel, puppetmaster will not regenerate its CA.
- Wipe all the client certs
/etc/init.d/puppet stop rm $vardir/ssl/*
- Have each client request a new cert:
puppetd --onetime --debug --ignorecache --no-daemonize
- Once all the requests have rolled in, you can sign them all at once:
puppetca --sign --all
- Start up your puppet clients:
/etc/init.d/puppet start
You could also enable autosign temporarily, if you are comfortable with that.
Sendmail (both in Etch and in Lenny) optionally creates default OpenSSL certificates at install time.
The key rollover procedure is trivial:
/usr/share/sendmail/update_tls new
If you have customized the templates in /etc/mail/tls, those values will be re-used to create the new certificates.
The snakeoil certificate /etc/ssl/certs/ssl-cert-snakeoil.pem can be recreated with:
make-ssl-cert generate-default-snakeoil --force-overwrite
rm -f /etc/telnetd-ssl/telnetd.pem /etc/ssl/certs/telnetd.pem dpkg-reconfigure telnetd-ssl
This covers the default setup. If the local admin has setup further SSL infrastructure beyond that, these keys will need to be regenerated as well.
Remove all suspect public and private key files:
- Remove rsa_key.priv.
- Edit all files in the hosts/ directory and remove the public key blocks.
Generate a new public/private key pair:
tincd -n <netname> -K
Exchange your host config file with the new public key with other members of your VPN. Do not forget to restart your tinc daemons.
Tor is not in stable, but affected in Lenny.
Clients running 0.1.2.x are not affected. Tor nodes or hidden service providers running any version, as well as everyone on 0.2.0.x are affected.
Please see the vulnerability announcement on the Tor announce mailing list.
Upgrading to 0.1.2.19-3 (available in testing, unstable, backports.org, and the usual noreply.org repository) or 0.2.0.26-rc-1 (available in experimental and the usual noreply.org repository) is recommended. If you run a relay these versions will force new server keys (/var/lib/tor/keys/secret_*) to be generated.
Should you run a Tor node without using the package's infrastructure (debian-tor user, /var/lib/tor as DataDirectory etc.) you manually need to remove bad keys. See the advisory link posted above.
If you are a hidden service provider, and have created your key in the affected timeframe with a bad libssl then please delete your hidden service's private key. This will change your hidden service's host name and may require reconfiguring your servers.
If you are running 0.2.0.x, an upgrade is highly recommended — 3 of the 6 v3 authority servers have compromised keys. Old 0.2.0.x versions will stop working in a week or two.
xrdp uses generated keys. Most clients do not check those keys by default, therefore changing them is painless. You just have to:
rm /etc/xrdp/rsakeys.ini /etc/init.d/xrdp restart
xrdp is not in stable.


text:
Na'ale: The World's Jewish High School
Na'ale: The World's Jewish High School, also called Elite Academy, allows parents in Jewish communities abroad to register their 10th-grade children for three years of tuition-free Israeli high school, leading to an Israeli "matriculation" diploma.
Teenagers from communities all over the Jewish world have the opportunity to finish their schooling in the homeland. They will learn Hebrew, build life-long friendships with peers from the world over, and develop a lasting relationship with the land through fun and educational trips and cultural activities.
Na'ale includes room and board, a monthly stipend, fees for extracurricular activities, home hospitality, and other support services.
The program was founded in 1992, and since has provided world-class Jewish and Zionist education to over 13,000 motivated Jewish teenagers from around the world. In the 2011-12 school year, Na'ale had students from 32 different countries. The largest contingents were from the FSU, the United States, Argentina, Brazil, South Africa, France, and Germany.
Na'ale currently includes 25 participating high schools - both religious and secular - all over the country.

subset: commoncrawl


text:
Temperature inside collapsing bubble four times that of sun
Using a technique employed by astronomers to determine stellar surface temperatures, chemists at the University of Illinois at Urbana-Champaign have measured the temperature inside a single, acoustically driven collapsing bubble.
Their results seem out of this world.
"When bubbles in a liquid get compressed, the insides get hot -- very hot," said Ken Suslick, the Marvin T. Schmidt Professor of Chemistry at Illinois and a researcher at the Beckman Institute for Advanced Science and Technology. "Nobody has been able to measure the temperature inside a single collapsing bubble before. The temperature we measured -- about 20,000 degrees Kelvin -- is four times hotter than the surface of our sun."
This result, reported in the March 3 issue of the journal Nature by Suslick and graduate student David Flannigan, already has raised eyebrows. Their work is funded by the National Science Foundation and the Defense Advanced Research Projects Agency.
Sonoluminescence arises from acoustic cavitation -- the formation, growth and implosion of small gas bubbles in a liquid blasted with sound waves above 18,000 cycles per second. The collapse of these bubbles generates intense local heating. By looking at the spectra of light emitted from these hot spots, scientists can determine the temperature in the same manner that astronomers measure the temperatures of stars.
By substituting concentrated sulfuric acid for the water used in previous measurements, Suslick and Flannigan boosted the brilliance of the spectra nearly 3,000 times. The bubble can be seen glowing even in a brightly lit room. This allowed the researchers to measure the otherwise faint emission from a single bubble.
"It is not surprising that the temperature within a single bubble exceeds that found within a bubble trapped in a cloud," Suslick said. "In a cloud, the bubbles interact, so the collapse isn't as efficient as in an isolated bubble."
What is surprising, however, is the extremely high temperature the scientists measured. "At 20,000 degrees Kelvin, this emission originates from the plasma formed by collisions of atoms and molecules with high-energy particles," Suslick said. "And, just as you can't see inside a star, we're only seeing emission from the surface of the optically opaque plasma." Plasmas are the ionized gases formed only at truly high energies.
The core of the collapsing bubble must be even hotter than the surface. In fact, the extreme conditions present during single-bubble compression have been predicted by others to produce neutrons from inertial confinement fusion.
"We used to talk about the bubble forming a hot spot in an otherwise cold liquid," Suslick said. "What we know now is that inside the bubble there is an even hotter spot, and outside of that core we are seeing emission from a plasma."
Source: University of Illinois at Urbana-Champaign


text:
If nothing else at all in 2012, the New York Jets will provide a interesting litmus test for the NFL...exactly how much does the preseason mean?
Head coach Rex Ryan and Co. were the target of critique, criticism and downright catcalling during an 0-4 August run in which the regular defense was particularly effective, but the first-string offense was awful.
The unit failed to reach the end zone once in the three games it appeared, and the Jets as a whole didn't score a touchdown until the reserves took the field in a game-four walk-through against the Philadelphia Eagles.
But put it all together and Ryan is still, well...Ryan.
"I truly feel that this will be the best team that I've had since I became head coach of the Jets," he said, while falling short of the Super Bowl guarantees he's delivered periodically prior to his first three seasons at the helm.
"All that work that you've done, all the work that the players have done, the lifting and all the meetings and things, it's for this," said Ryan in reference to New York's season opener against the Buffalo Bills at MetLife Stadium. "It's not to win a preseason game. It's to be at your very best when the regular season starts."
New York's offense stumbled down the stretch in 2011 as an 8-5 start devolved to an 8-8 finish and marked the first time in quarterback Mark Sanchez's three seasons that the Jets failed to reach the AFC Championship Game.
The ex-USC starter posted a 60.3 passer rating and threw seven of his 18 interceptions in the final stretch, which actually ended with Sanchez setting career-bests in completions (303), passing yards (3,474), touchdown passes (26) and quarterback rating (78.2).
And since the season-ending defeat in Miami, he's been joined on the roster by fellow quarterback Tim Tebow, who's subsequently been the source of a media frenzy in anticipation of a signal-calling controversy the Jets insist won't occur.
Also new to the fold is offensive coordinator Tony Sparano, the former Dolphins head coach who comes over from Miami after authoring significant success with Wildcat schemes.
Adding to the mystery is the lack of definition of exactly what role Tebow, who led Denver to an AFC West title and a playoff win last season, will play.
"As much as people are trying to make it a quarterback controversy, it's not," Ryan said. "Mark is our starting quarterback, and Tim is an excellent football player. I guess we never appeased whoever by not putting [Tebow] out there.
"If that added to it, that wasn't our intent. Our intent was there's no sense showing [the Wildcat] right now in the preseason, just like I'm sure a lot of teams are saving specific things for their openers. We're not different than a lot of teams doing that."
Back at wide receiver is Santonio Holmes, who had a much-publicized rift with Sanchez and teammates as last season disintegrated. He made just one catch in limited preseason action.
"We'll find out Sunday," Holmes said when asked how the offense will perform. "We'll find out just how much we've been putting together throughout the offseason. I think it's going to be pretty exciting for us."
As for the Jets' defense, it's at least a known - and confident - quantity.
"We plan to be the best," end Mike DeVito said. "It doesn't matter what anybody else is doing. We plan to be the best defense. We plan to not let up scores and we plan to go out there and shut down offenses. That's our deal, so nothing else matters. Not what anyone says or does. It's all about what we're doing."
The Bills plan on a similar defense-first approach to end a playoff drought that stretches back to the "Music City Miracle" loss to Tennessee in January of 2000.
Buffalo was an early factor while winning five of seven games to begin 2011, but dropped a 27-11 home decision to the Jets the following week and won just once the rest of the way to finish 6-10.
In the offseason, they added defensive ends Mario Williams and Mark Anderson to boost a group that surrendered 5,938 total yards and registered just 29 sacks.
The Bills, under the leadership of head coach Chan Gailey, will also switch to a 4-3 scheme in 2012.
"This is where we make the money," said defensive tackle Marcell Dareus, who had 5 1/2 sacks as a rookie last season. "This is what they pay us the big bucks for. They made a great investment on the front four, and I'm pretty sure we won't disappoint them."
The Bills go again with quarterback Ryan Fitzpatrick to lead the offense after establishing 2011 career-bests in passing yards (3,832), touchdown passes (24) and completion percentage (62.0), but threw 23 interceptions.
He slumped badly after the Bills' hot start and earning a lucrative contract extension, throwing 16 interceptions and racking up a a 66.5 passer rating in the final nine games.
Wide receiver Stevie Johnson also returns after two straight 1,000-yard seasons and is billed by some as the personal nemesis of Jets cornerback Darrelle Revis after catching 11 passes for 159 yards and one touchdown - the only one scored on Revis last season - against the Jets in 2011.
"It's the competition, I love it," said Johnson about Sunday's matchup. "With [Revis] being arguably one of the best cornerbacks in the league, it's an opportunity to put myself out there and let the world know that Stevie Johnson is a player in this league. It's a competition thing. I've been fortunate to get a few passes on him.
"I'm working on getting the "W", though."
Bills lead 53-49
Streak: Jets have won last five meetings 2011 Meetings: Jets 27, Bills 11 (Nov. 6 at Buffalo) Jets 28, Bills 24 (Nov. 27 at New York)
Bills HC Chan Gailey vs. Jets: 0-5 overall, 0-4 with Bills Jets HC Rex Ryan vs. Bills: 5-1 Gailey vs. Ryan Head-to-Head: Ryan leads, 4-0
Notes: Jets have won seven of eight matchups with Buffalo over the last four seasons, with the Bills' lone victory a 16-13 road overtime triumph in 2009 in which a then-rookie Sanchez threw five interceptions. Gailey's first loss against New York came in 1999 while then the head coach of Dallas. Buffalo took the only postseason clash between the divisional foes to date, scoring a 31-27 victory at Shea Stadium in a 1981 AFC First Round Playoff.
2011 Offensive Team Rankings
Buffalo: 14th overall (351.5 ypg), 13th rushing (120.1 ypg), 15th passing (231.4 ypg), 14th scoring (23.3 ppg)
N.Y. Jets: 25th overall (311.8 ypg), 22nd rushing (105.8 ypg), 21st passing (206.1 ypg), 12th scoring (23.6 ppg)
2011 Defensive Team Rankings
Buffalo: 26th overall (371.1 ypg), 28th rushing (139.0 ypg), 19th passing (232.1 ypg), 30th scoring (27.1 ppg)
N.Y. Jets: 5th overall (312.1 ypg), 13th rushing (111.1 ypg), 5th passing (201.0 ypg), 20th scoring (22.7 ppg)
2011 Turnover Margin
Buffalo: +1 (31 takeaways, 30 giveaways) N.Y. Jets: -3 (31 takeaways, 34 giveaways)
2011 Red Zone Touchdown Percentage (offense)
Buffalo: 52.8 percent (53 possessions, 28 TD, 15 FG) -- 11th overall N.Y. Jets: 65.5 percent (55 possessions, 36 TD, 11 FG) -- 1st overall
2011 Red Zone Touchdown Percentage (defense)
Buffalo: 64.4 percent (59 possessions, 38 TD, 14 FG) -- 32nd overall N.Y. Jets: 52.3 percent (44 possessions, 23 TD, 16 FG) -- 16th overall
The most lingering memories of the Bills' offense against the Jets defense last season involved Johnson (76 receptions, 1004, 7 TD in 2011), who was the lone wideout to catch a touchdown pass against Revis over the 16-game schedule. However, he also dropped what would have been a decisive scoring catch in a four-point loss at New York at MetLife Stadium. From top to bottom, the Bills personnel is largely the same, with Fitzpatrick (24 TD, 23 INT) back after he threw for 3,832 yards to join Drew Bledsoe (4,359, 2002) and Hall of Famer Jim Kelly (3,844, 1991) as the only Bills quarterbacks to reach 3,800 passing yards in a single season. He also had a career-best with 24 touchdown passes. Fitzpatrick completed 26-of-39 throws (66.7 percent) for 264 yards, three touchdowns and a 111.5 rating in Buffalo's last meeting with the Jets back in November. Running backs Fred Jackson (934 rushing yards, 6 TD, 39 receptions) and C.J. Spiller (561 rushing yards, 39 receptions, 6 total TD), who combined for 1,495 rushing yards in 2011, are the main ground options. A second option behind Johnson at wideout is Donald Jones (23 receptions, 1 TD), who enters his third NFL season after catching 41 passes and scoring twice in his initial two. Tight end Scott Chandler (38 receptions, 6 TD) tied Pete Metzelaars (1992) and Jay Riemersma (1998) for the most touchdown catches by a tight end in a single season in the team's history last year.
For the Jets, all preseason reviews indicate a return to the defensive prowess of coordinator Mike Pettine's initial two seasons on the job. Safeties LaRon Landry (48 tackles, 1.5 sacks with Redskins) and Yeremiah Bell (107 tackles, 2 sacks, 1 INT with Dolphins) were brought in during the offseason and end Quinton Coples was the 16th overall draft pick after two straight all-ACC seasons at North Carolina. He's earned high praise for his performance over the four preseason games. Linebacker Aaron Maybin was selected No. 11 overall by the Bills in the 2009 NFL Draft and resurrected his career last season with the Jets, leading the team with six sacks.
Ryan and everyone else associated with the Jets have promised a return to the "ground-and-pound" offensive attack that helped the team to consecutive AFC Championship Game appearances after the 2009 and 2010 seasons. New York got away from that philosophy and was more pass-heavy in 2011, then suffered when Sanchez (3474 passing yards, 26 TD, 18 INT) sputtered down the stretch. Of course, the million-dollar question in training camp - and everywhere else - has been how much the Jets will use new backup Tebow (660 rushing yards, 6 TD with Broncos) in the mix created by new offensive coordinator Sparano, who leaned heavily on the Wildcat scheme in his days with the Dolphins. Running back Shonn Greene comes off a career-best 1,054 yards and six touchdowns last season and enters this year as the feature back. Among the receivers, tight end Dustin Keller tweaked a hamstring in a preseason game but is expected back for the opener, and recorded a team-high 65 catches and 815 receiving yards last season. Among the wideouts, the veteran Holmes (51 receptions, 8 TD) made nice with his teammates after a much-publicized rift in the 2011 finale at Miami. He's scored in three straight games against the Bills. Up front, the Jets replaced balky right tackle Wayne Hunter with Austin Howard and recently traded for Jason Smith, a former No. 2 overall pick with St. Louis.
Howard's immediate challenge will be fending off a suddenly ferocious Bills pass rush that includes free-agent signees Williams (11 tackles, 5 sacks with Texans) and Anderson (29 tackles, 10 sacks with Patriots). Williams had two sacks in his last game against the Jets, which came while with Houston in November of 2010. Anderson, drafted by the Chicago Bears in 2006, has 35 1/2 career sacks in 93 games with three teams. In the backfield, safety George Wilson (106 tackles) tied a career-high with four interceptions last season and fellow safety Jairus Byrd (75 tackles, 1 sack, 3 INT) has picked off four passes in six career games against the Jets. Also, cornerback Stephon Gilmore makes his professional debut after he was selected 10th overall in April's draft.
The overwhelming majority of playmakers on either team are on the defensive side of the ball, which will most likely lead to a competitive game in which limiting mistakes is at a premium. How well Howard or Smith are able to deal with Williams and Anderson will determine the mistake quotient for Sanchez, who tends to make them in bunches and at inconvenient moments. If the right tackle position is stable, it'll free the quarterback up for the quick-hitting passes he thrives on. Meanwhile, it's a litmus test for Pettine's New York defense that smothered the Bills in the teams' initial meeting last season in Buffalo. Unless Johnson can break out with a difference-making big play or two against Revis, the Jets seem more likely to turn a turnover into decisive points in their home opener.
Sports Network Predicted Outcome: Jets 20, Bills 14


text:
This bottom bracket is for BB86 Road bikes with BB86 bottom bracket standard. This bottom bracket uses Road seals for maximum efficiency and minimal friction, not recommended for harsh weather, CX, or the like.
Kogel believes that quality ceramic bearings set the gold standard for ball bearings in bicycles. Silicon Nitride combines a set of material properties that make it perfect for bicycle bearings. The material is hard, resistant to wear, can be made into perfectly round balls with super tight tolerances and can be polished smoother than any metal. On top of all that, the material does not rust or oxidize.
Kogel's races are made out of hardened steel and are polished to a mirror finish. These steps are necessary to make a perfect match between the hardness of the balls and the races.
Kogel Bearings offers two seal types for different use: we have our road seals, a minimal contact seal that is designed to keep the elements out and the friction low. The cross seals are designed for extra protection from contamination: dust, water and mud.
Kogel Bearings is very much aware of the bad reputation ceramic bearings have when it comes to durability. We blame this mostly on sub-par quality bearings being sold as high quality. A bearing needs to be balanced: the hardness of the balls needs to be matched with equally smooth and hard races. Bearing retainers, seals and greases must be balanced to work in unity. If one of the components is not matched with the others, it will throw off the performance of the entire bearing. The result being high drag, a shortened life span or major failure.
To prove that we believe in our products, we guarantee them to be running for at least 2 years. If anything happens in the first year, we will repair or replace your product with very few questions asked. After that first year, we want the bearings to be serviced by a qualified mechanic. This service involves cleaning, regreasing and replacing of the seals. This will extend the warranty for another year.
Frame Interface: BB86/92
Spindle Interface: 24mm (Shimano Hollowtech II, SRAM/Truvativ GXP w/ Reducer)
Bottom Bracket Shell ID: PF41
Shell Width: 86mm
Material: Ceramic Bearings (Road Seals)
Color: Black
Weight: TBD
This product was added to our catalog on April 4, 2017


text:
For Standalone or Project Template
KUMAON is Retina ready template which is perfect for your upcoming project. Built on top of Boostrap from Twitter, it promises well organized HTML & CSS structure upgraded with fluid & responsive design.
Quick-Start Your Bussines Today!
Built on Top of Bootstrap 2.3.2 (Latest)
15+ Unique Handcrafted Pages
All in one package. Wheither you are building a blog, portfolio or company presentation page, KUMAON has it all. In download you wil get: Beautifully crafted home page with custom made portfolio, 2 blog pages, 3 standalone portfolios, full width page with tables, expandables, buttons etc., about us page for presentation of your employes, contact page, 404 page & More!
Theme Features
- Fluid & Responsive Design (Optimized & Tested on Ipad & Iphone)
- Built on Top of Boostrap From Twitter
- Color scheme CSS framework for quickly changing all the colors on the website
- Built Entirely For Retina & Mobile Displays
- 2 Custom portfolios
- Full Width Page
- Single Page
- Contact Page With Google Maps API
- Social Icons (Facebook, Twitter, Pinterest, LinkedIn)
- Multiple extra widgets (Fancybox, Carouse, Instagram, Flickr & Twitter)
- Support for Various Formats (Galleries, Portfolios, Quotes, Links, Videos)
- Font Awsome Support With 300+ Retina Ready Icons
- Prototype Mobile Slider – Angle Slider & Fraction Slider
- Google Fonts
- Fluid Columns
- Drop Down Menus
- Clean & Documented HTML & CSS Code
- Documentation in a Handy PDF Format
- More
Important notice: Photos as shown in demo are not included in the download.
Theme Updates
Also Features
Get New Theme Releases & Updates by Email!
Sign in to TemplateStock newsletter and we'll keep you up to date with new theme updates, early screenshots of our futures themes, freebies & more! Sign up for the newsletter over here