Linux – the maximum username length on current GNU/Linux systems

For more data on the layout of Linux file-systems, look at the Filesystem Hierarchy Standard (now at version 2.3, with the beta 3.0 version deployed on most recent distros). It does explain some of where the names came from:

• /bin - Binaries.
• /boot - Files required for booting.
• /dev - Device files.
• /etc - Et cetera. The name is inherited from the earliest Unixes, which is when it became the spot to put config-files.
• /home - Where home directories are kept.
• /lib - Where code libraries are kept.
• /media - A more modern directory, but where removable media gets mounted.
• /mnt - Where temporary file-systems are mounted.
• /opt - Where optional add-on software is installed. This is discrete from /usr/local/ for reasons I'll get to later.
• /run - Where runtime variable data is kept.
• /sbin - Where super-binaries are stored. These usually only work with root.
• /srv - Stands for "serve". This directory is intended for static files that are served out. /srv/http would be for static websites, /srv/ftp for an FTP server.
• /tmp - Where temporary files may be stored.
• /usr - Another directory inherited from the Unixes of old, it stands for "UNIX System Resources". It does not stand for "user" (see the Debian Wiki). This directory should be sharable between hosts, and can be NFS mounted to multiple hosts safely. It can be mounted read-only safely.
• /var - Another directory inherited from the Unixes of old, it stands for "variable". This is where system data that varies may be stored. Such things as spool and cache directories may be located here. If a program needs to write to the local file-system and isn't serving that data to someone directly, it'll go here.

/opt vs /usr/local

The rule of thumb I've seen is best described as:

Use /usr/local for things that would normally go into /usr, or are overriding things that are already in /usr. Use /opt for things that install all in one directory, or are otherwise special.

You may want to dig a little deeper before 'fixing' this and make sure your changes are fully thought-out. Of the files you mentioned:

I happen to know that /etc/passwd has to be readable for any number of programs (ls) to access user name information in standard configurations. Nothing in /etc/passwd is secret or privileged on any modern machine as that's what the shadow files are for, or the secrets are hosted on the network via LDAP, Kerberos or some other such thing.

I'm less sure about the other two. cron runs as the user whose jobs it is executing, so it probably needs to be able to read that file as any user who can run cron. Any user on an average system can run last,w to see recent and current logins (read from lastlog and wtmp, afair), and so these files are readable. You may certainly remove those commands, or user access to them, and then you might want to change the perms on the files or remove them altogether, once you are quite certain they are not used.

The Securing Debian Manual may be able to answer more of these questions for you or explain things better. Although it is not actively maintained it is still quite good. Other distros have similar resources.