Why does the linux XRDP module use a 512 bit RSA key? 512 bit RSA keys are broken by now. How can this be safe?
Basically it is not safe. As far as I know, they use 512-bit RSA because they mimic what Microsoft's RDP server used to do, which indeed implied a 512-bit RSA key; using something bigger would risk breaking compatibility with existing clients. Biggest issue, though, is not that the 512-bit key is weak because too short; the main problem is that, as a client, you have no way to make sure that the key is see is indeed the one from the genuine server. Man-in-the-Middle attacks are a plausible possibility, and increasing the key size to 2048 bits would not help in any way.
Relationship of RDP with security is complicated and convoluted. The protocol has historically used its own embedded security system, something roughly SSL-like, but never analysed with any decent level of detail. Previously it did not even encrypt anything, or just the user password. If you want security with RDP, you should use it within a VPN; on Linux, consider SSH as a way to initiate cheap but robust tunnels. Microsoft pushes their own mechanism, called Remote Desktop Gateway -- basically wrapping the complete protocol into a regular SSL tunnel.