If you still use DES password hashing, the limit is 8 characters. But I don't think any distro by default uses DES anymore; AFAIK they're all MD5 now, which has no such limit.

To find out for sure, you can check whether the "shadow" package is installed (it also has to be compiled with MD5 enabled, but it almost always is). If it is installed, then look in its /etc/login.defs file for the MD5_CRYPT_ENAB directive. It should be YES.

As far as usernames go, I've never heard of a limit. The Linux admin FAQ page seems to confirm:

clicky

In short, it only matters if you need the username in wtmp and utmp to match the actual username (the limit in those files is 32 bytes; everybody uses libc6/glibc2 now).