External AS/AV Integration

[Will Froning <wfroning@aus.edu>]

Hello All,

We finally got our new AV/AS system (IronPort) and I'm trying to integrate it into Zimbra and disable SpamAssassin.  Here are some thoughts/questions to see if you guys have attempted the same.

1) I tried having the IronPort add a "X-Spam-Flag: YES" flag, but as I suspected amavisd just replaces the value with whatever it thinks is correct.  I suspect that changing the header to X-AUS-Spam-Flag on both IronPort and zimbraSpamHeader on Zimbra will result in the same thing.  I'm willing to disable amavisd if it's possible to keep clamav online, but would disabling amavisd break the filtering into the Junk folder based on the zimbraSpamHeader & zimbraSpamHeaderValue?  And can you just enable one or the other (not just setting the kill rate to 100 or some such)?

2) IronPort training accounts are publicly listed as spam@access.ironport.com and ham@access.ironport.com.  I initially considered just changing zimbraSpamIsNotSpamAccount & zimbraSpamIsSpamAccount values to match them, but now I'm wondering if just adding a forward rule to the system ham/spam accounts wouldn't be better since I can keep a local copy as a reference.  Anyone have any experience one way or another on that?

3) Finally, has anyone rolled out changing the amavisd postfix channel to an external scanner (like IronPort)?  Sometime this summer I'll end up messing with it, but wasn't sure if anyone had experience they are willing to share on the subject.

Any help on AV/AS integration is welcome. :)

Thanks,
Will

-- 
Will Froning
Sr. Systems Architect
American University of Sharjah
PO Box 26666
Sharjah, UAE

Tel:  +97165152124