refusing rlogin requests from select hosts

[Mike Rimkus]

Say we want most of our users to be able to log in only from on-site
machines, while other users should be able to log in from any machine.
Has anyone seen an implementation of rlogind that does this, i.e.,
restricts logins only to a specified set of client-machine/user
combinations?  (I'm not referring to logins w/o a password, like
hosts.equiv allows, but any logins whatsoever.)  Is anyone out there
familiar with rlogind, who can suggest a strategy for modifying it to this
effect?

I will summarize if there is interest.