Interpreting the Hash type in a TLS ciphersuite
Does this always refer to SHA1


Yes, within TLS ciphersuites, an unadorned "SHA" means SHA-1.  The oldest of these ciphersuite names predate any of the SHA2 hashes (and so if they use them, they'll explicitly list the size, e.g. SHA256), and SHA-0 is never used.



From the Glossary (appendix B) in RFC 5248: TLS 1.2:


  SHA
  
  The Secure Hash Algorithm [SHS] is defined in FIPS PUB 180-2.  It
        produces a 20-byte output.  Note that all references to SHA
        (without a numerical suffix) actually use the modified SHA-1
        algorithm