I am an idiot... it was a simple case that I assumed zero for uppercase O
The credentials printed when I booted the VM are accepted... it was finger/figure? trouble...
I understood what I'd done just as your response arrived... I'll say it for you... i am an idiot...
If it helps someone else I saw my problem when I used curl, rather than using a browser from another host:
When I tried with the incorrect password (the zero):
curl -u user:xxxx0 http://localhost/elk/app/kibana
curl returns a 401 response
With the correct password (uppercase O):
curl -u user:xxxxO http://localhost/elk/app/kibana
returns the expected kibana welcome page.
It was only when I used curl and saw what I'd typed that I understood the probable mistake.
Thanks for the response.