First up sorry for the delay, much is going on.
Secondly I like your position in regard to keeping it user dependent, solely for the fact that they can decide what is SPAM and what is HAM.
However some of my clients freak out when they receive any SPAM even in their Junk folder. I guess its to be expected and that is all part of helping them understand.
I setup my server with ISPConfig 3 and Debian Squeeze using this tutorial:
Part of the tutorial is to include Amavisd-new, SpamAssassin and Clamav. So my system (if not mistaken) is similar to yours.
You mention a Plugin for Dovecot (which I use) is that simply just following this tutorial: http://wiki2.dovecot.org/Plugins/Antispam
or is something more involved? I don't want to mess anything up with ISPConfig 3 either.
Awhile ago I used this tutorial
to "harden" my system but after some input from other members I choose not to change all the ports for ISPConfig, phpmyadmin, etc. However is any of this usable? For example it talks about php speed increasing and mysql database tuning... Are these industry accepted methods??
Thank you for your time,