This all depends on what you are hardening against, some basic steps are to install fail2ban and limit SSH to your home/office IP. You can disable and remove s

This all depends on what you are hardening against, some basic steps are to install fail2ban and limit SSH to your home/office IP. You can disable and remove services you don't use and turn on auto-update and that will be good enough for day to day use in my opinion.