> The next thing I would like to do is to figure out exactly who on the remote
> host has executed the "finger @" command.  Would this be possible?

Ah, that's an easy question, which I'll answer with two questions.

Suppose I take a single-board micro, put a TCP/IP stack on it, and have it
issue finger connection requests to your system from its boot prom.

Who is executing finger?

For a less extreme example (which may therefore be more or less convincing),
suppose I take my NetBSD system, boot it to single user mode, add user id's
constructed as "user000" through "user999", and then write a tedious shell
script using sudo or some similar program to run finger as each uid.

Who is executing finger?	(me, or user550?)

If you're still convinced that the question has a meaning, much less an
answer, the final answer is that the existing finger programs certainly don't
make any effort to provide that information.  But the real answer is that
if you care about the answer to the question, you can't believe any answer
that you come up with.

------------------------------------------------------------------------------