Use a regular expression:

# ...

unless($os_user =~ m/^[A-Za-z]{3}[0-9]{3}$/) {
   die "Invalid username: $os_user";
}

# ...
[download]

Depending on what letters and digits are allowed exactly (Unicode has a bunch more), you may want to use \p{IsAlpha} and/or \p{IsDigit} instead of [A-Za-z] and [0-9], too -- though you'll also have to use open IO => ':encoding(UTF-8)', ':std'; for that.