diff --git a/sesman/config.c b/sesman/config.c
index 8a11ef09..2322ea67 100644
--- a/sesman/config.c
+++ b/sesman/config.c
@@ -228,6 +228,7 @@ config_read_security(int file, struct config_security* sc,
 
   /* setting defaults */
   sc->allow_root = 0;
+  sc->login_retry = 3;
   sc->ts_users_enable = 0;
   sc->ts_admins_enable = 0;
 
@@ -239,6 +240,10 @@ config_read_security(int file, struct config_security* sc,
     {
       sc->allow_root = text2bool((char*)list_get_item(param_v, i));
     }
+    if (0 == g_strcasecmp(buf, SESMAN_CFG_SEC_LOGIN_RETRY))
+    {
+      sc->login_retry = g_atoi((char*)list_get_item(param_v, i));
+    }
     if (0 == g_strcasecmp(buf, SESMAN_CFG_SEC_USR_GROUP))
     {
       if (g_getgroup_info((char*)list_get_item(param_v, i), &gid) == 0)
@@ -260,6 +265,7 @@ config_read_security(int file, struct config_security* sc,
   /* printing security config */
   g_printf("security configuration:\r\n");
   g_printf("\tAllowRootLogin:       %i\r\n",sc->allow_root);
+  g_printf("\tMaxLoginRetry:        %i\r\n",sc->login_retry);
   if (sc->ts_users_enable)
   {
     g_printf("\tTSUsersGroup:         %i\r\n", sc->ts_users);
diff --git a/sesman/config.h b/sesman/config.h
index b2665010..7c04727f 100644
--- a/sesman/config.h
+++ b/sesman/config.h
@@ -56,6 +56,7 @@
 #define SESMAN_CFG_LOG_SYSLOG_LEVEL  "SyslogLevel"
 
 #define SESMAN_CFG_SECURITY          "Security"
+#define SESMAN_CFG_SEC_LOGIN_RETRY   "MaxLoginRetry"
 #define SESMAN_CFG_SEC_ALLOW_ROOT    "AllowRootLogin"
 #define SESMAN_CFG_SEC_USR_GROUP     "TerminalServerUsers"
 #define SESMAN_CFG_SEC_ADM_GROUP     "TerminalServerAdmins"
@@ -76,9 +77,14 @@ struct config_security
 {
   /**
    * @var allow_root
-   * @brief
+   * @brief allow root login on TS
    */
   int allow_root;
+  /**
+   * @var login_retry
+   * @brief maximum login attempts
+   */
+  int login_retry;
   /**
    * @var ts_users
    * @brief Terminal Server Users group
diff --git a/sesman/sesman.ini b/sesman/sesman.ini
index 6f8dd701..48a8a748 100644
--- a/sesman/sesman.ini
+++ b/sesman/sesman.ini
@@ -6,6 +6,7 @@ DefaultWindowManager=startwm.sh
 
 [Security]
 AllowRootLogin=1
+MaxLoginRetry=4
 TerminalServerUsers=tsusers
 TerminalServerAdmins=tsadmins
 
@@ -27,4 +28,4 @@ param2=-ac
 
 [Xvnc]
 param1=-bs
-param2=-ac
\ No newline at end of file
+param2=-ac