What was the issue was that I was being tricksy and using port 80 with all three of the sites (SSP Admin, MySite and Portal) and using host headers to identify them. Without any changes, this causes a 401.1 error because in Microsoft's words: "...the Web Site uses Integrated Authentication and has a name that's mapped to the local loopback address."
In the Microsoft KB article, there are two fixes, both involve editing the registry:
- Specify host names in the BackConnectionHostNames multi-string value, or
- Disable the loopback check.
The second one is easier if it's a dev environment, but the first is preferred if using NTLM authentication.