On Linux, is it necessary that the amavis user have a valid login shell such as /bin/sh? For security I would prefer it to use a null shell. If it makes a difference, our amavis calls clamdscan with --fdpass (the 'modern' way). And of course amavis uses SA in the normal way.