Not trivially ... from a network layer perspective an incoming
ssh connection will first be owned by the root user who runs sshd.
You could have a look at
http://www.nufw.org/ which, as far as I
understand, has the facility to log user traffic.
Cheers,
Tink
