You could monitor who is viewing which page, by having some kinda tracking script called via SSI on each page (you can't get that kinda info any other way).
As for seeing who is online, the tracking script could read the env variable to get the person's username, and write it to some kinda database, from which you can get a listing. If the user is not logged in, that env var will not exist or will be empty, so you can have the script react accordingly.