Like era said, accouting will do the job, but it will only give you the commands executed by a given user, not the IP address he/she used to enter your machine.

For something really accurate you could use grsecurity's patches which specially create a proc entry with the ip address of the user who created a given process.

Not sure if selinux would help you with this.

RSBAC also gives you IP information in its logs.