Hardening against vulnerabilities is a zero sum game ultimately.

It is my experience that most guides you will find for Linux hardening are either outdated, too opinionated or are written with shock value to induce paranoia [0].

I harden ssh (no root login, no passwords), setup fail2ban for it and leave it at that.

Only thing I remember to do is not to mess with security configurations e.g disabling selinux to make something work. Keeping number of software installed to an absolute minimum. And last but not least I setup automatic updates via unattended-upgrades.

[0] https://madaidans-insecurities.github.io/guides/linux-harden...