Between 6 and 20 characters for a password is acceptable, although I would normally not restrict the password length quite so tightly at the max end (see my final comment in bold, below).
A username however should be able to be short. If your application requires the username to be unguessable, then you might as well ask for two passwords rather than one.
If I'm an early adopter of a product/website/startup I like to be able to choose a short username - perhaps my first name, after all it's usually a name by which I refer to myself in the context of your application, and an id by which the application will refer to me.
Therefore I would think twice before restricting the minimum length of a username at all - other than non-blank of course. In any case you need to validate a username against those that exist already (I suggest in-line validation here).
With respect to the maximum length, anyone who enters a really long username is digging a hole for themselves anyway as they may well end up having to type that username frequently in the future.
You should also think beyond the textbox max-length restriction as to where and how that username mught be stored, displayed and used in the future. Could it ever form part of an email address, a filename, a sub-level domain prefix, etc, etc. (I'm sure you'll have more pertinent questions for your own application context).
I'm torn between the 'why restrict it at all' option and the 'keep it short enough never to be a problem'. I believe 32767 would be a mistake that could come back to bite you at some future point and I would advise an option where you can understand and deal with a known quantity in the future with the minimum of fuss.
For this reason, while taking the above consideration about future uses into account I would make the username length as long as possible, but no shorter than necessary.