Updating openssh has been a frustrating experience recently because of their constant breaking of old clients.
I hope this one doesn't continue this worrying tendency.
I hope this one doesn't continue this worrying tendency.
If your clients are broken, they should be updated.
There is no problem using aes128-ctr as far as I know.
Finally, diffie-hellman-group14-sha1 is not ideal, but breaking sha1 requires vast resources.
An sshd allowing these settings can talk to very, very old versions, and the CPU usage of these is light compared to some of the more modern configurations.
I do have systems that are sensitive to CPU usage, and I retain these settings there, where I am less concerned about ultimate protocol security, and more focused on performance and a light footprint.