Minecraft – Autopick items from inventory when emptying stack in hand

Unfortunately, it appears the answer is "you can't, or at least not without spending a prohibitive amount of time on the investigation, and even then you won't be sure of anything."

If someone finds a solution that's less time-intensive, I'll happily accept it instead of my own bleak conclusion. But after a lot of research I suspect there isn't one. I've updated the question to clarify that solutions ideally won't require hours of tedious manual work or monitoring.

I appreciate the answers that have been submitted so far. Unfortunately, manually searching everywhere for a stolen item would be too time consuming, and even upon finding it you couldn't be sure who put it there; it would be easy for a thief to frame someone else. And watching a potential crime spot continually until the crime happens would take too long since there are several possible griefers, many locations that could be griefed, and thefts are often spread out in time.

So for the time being the answer seems to be:

1. Use the techniques that I outlined in my question, whether using InvEdit to inspect player inventories, or else manually copying their [username].dat files to inspect inventories and Ender chests. If it's in their inventory or Ender chest, there's no question who took it.
2. Or give up and install Bukkit or Spigot and an anti-griefing plugin like WorldGuard or Prism.

We switched hosts and installed Spigot and Prism, and it was 100% worth the effort. Spigot runs even faster than Vanilla Minecraft did, and Prism is awesome for tracking down offenders and reverting their evil deeds.

Newer Fedora versions (Fedora 18 and onwards) use Firewalld to manage iptables rules. The iptables service that loads rules out of /etc/sysconfig/iptables is not present by default. A bunch of my answer involves manually bashing about in iptables rules. This is a bit of new ground for me, as my main experience with firewalld up to this point has been making a beeline back to traditional reading of iptables rules out of the save file. Most of the firewalld information was collected on the fly based on the iptables rules that it implemented.

I double-checked this on a Fedora 20 VM that I've been fiddling with. When a rule is set in firewall-config, the packet for a new connection must go through the following steps to be accepted.

1. New packet hits INPUT chain. Packets in existing connections are automatically accepted.
2. All prospective connections from the outside are sent to the either the INPUT_ZONES_SOURCE chain or INPUT_ZONES chain, based on whether they were picked out based on source IP or the interface the packet came in on. The logic within each is pretty much the same, other than the IP/interface note. I'll be focusing on INPUT_ZONES_SOURCE for my example.
3. I added my Minecraft rule to the 'home' zone, so I had added an entry in home->sources stating that packets coming from the network address of 10.20.30.0/24 were coming from home. In INPUT_ZONES_SOURCE, there was a rule that would send all packets coming from that IP range to the IN_home chain.
4. In the IN_home chain I had three chains dedicated to specific tasks: IN_home_log, IN_home_deny (this was empty, as I hadn't set anything), and IN_home_allow.
5. IN_home_allow held all of the allowed services for the 'home' zone, including the 25565 rule that I had just put in. Though I didn't start up a Minecraft server or bind anything else to TCP/25565, I could see that some other default rules did record that packets were being accepted, so traffic was being evaluated against this rule.
6. Any rule that does not get accepted will eventually splatter against the last rule of the INPUT chain. The final rule will reject any packet that is still on the chain.

To get to the point of my explanation, could I confirm that you've set an input interface or a IP address/range for the zone that you're allowing the port in? You've placed a rule to allow the port in a given zone, but it sounds as though the packet doesn't have a way to reach that rule and be accepted.

You can list a table using iptables -nvL. Firewalld sets up a lot of chains, so if you want to take a look at one in particular, add the chain name as an argument: iptables -nvL <chain-name>. If you can see numbers greater than zero in the lefthand columns, this means that packets have reached and triggered the rule. (The action the rule takes is in the third column).

To force your firewall to accept everything, and to see if something along the line is causing you grief, you could stop the firewalld service altogether temporarily.

systemctl stop firewalld

You can alternately flush the tables with iptables -F, though I'm not sure when/if firewalld will repopulate the chains on their own without a rule change to prompt it to do so.

Hopefully this will solve your issue. But if you want/need to go to a custom iptables layout by having the firewall load its rules out of /etc/sysconfig/iptables, you will need to install and enable the service, as well as disable firewalld.

1. Install iptables service: yum install iptables-services
2. Stop Firewalld: systemctl stop firewalld
3. Disable Firewalld: systemctl disable firewalld
4. Start the iptables service (If you don't have an /etc/sysconfig/iptables at this point, this won't do anything): systemctl start iptables
5. Enable the iptables service: systemctl enable iptables