How can I log every login via telnet?

[Anthony Atkielski]

Sandy Rutherford writes:

> See login.access(5) and login.conf(5).  Both provide this
> functionality.

I've tried this and I've obtained weird results.

Supposedly login stops at the first match in the login.access file.  So
I used this:

+:ALL:console
+:ALL:LOCAL
+:xxx yyy:ALL EXCEPT 216.134.77.112 161.13.67.41
-:ALL:ALL

The idea is to prohibit any logins from anywhere except the LAN and
console for all users except xxx and yyy (and even for those two logins
are not accepted from two specific IP addresses).  But as soon as I add
the -:ALL:ALL at the end, logins are disallowed for everyone except xxx
and yyy, even on the LAN, and even with ssh.  I'm perplexed.

-- 
Anthony