Since this question has been brought up from the vaults, my inclination would be to run swatch against
/var/log/auth.log (or your distro / syslog config's appropriate file), and configure it to respond with an email to each occurrence of
sshd.*Accepted.*, since this should catch both password-based and key-based logins:
Feb 21 10:06:44 lory sshd: Accepted publickey for username from ::1 port 39197 ssh2
Feb 21 10:08:16 bill sshd: Accepted password for username from ::1 port 46835 ssh2
which you could do with a config file saying, e.g.,
mail email@example.com,subject="SSH login on host foo"
swatch -c /the/above/file /var/log/auth.